The following updates has been released for Ubuntu Linux:

USN-3991-2: Firefox regression
USN-4008-3: Linux kernel (Xenial HWE) vulnerabilities
USN-4011-1: Jinja2 vulnerabilities
USN-4011-2: Jinja2 vulnerabilities

USN-3991-2: Firefox regression

==========================================================================
Ubuntu Security Notice USN-3991-2
June 06, 2019

firefox regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

USN-3991-1 caused a regression in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

USN-3991-1 fixed vulnerabilities in Firefox. The update caused a
regression which resulted in issues when upgrading between Ubuntu
releases. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 Multiple security issues were discovered in Firefox. If a user were
 tricked in to opening a specially crafted website, an attacker could
 potentially exploit these to cause a denial of service, spoof the browser
 UI, trick the user in to launching local executable binaries, obtain
 sensitive information, conduct cross-site scripting (XSS) attacks, or
 execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,
 CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701,
 CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819,
 CVE-2019-9820, CVE-2019-9821)
 
 It was discovered that pressing certain key combinations could bypass
 addon installation prompt delays. If a user opened a specially crafted
 website, an attacker could potentially exploit this to trick them in to
 installing a malicious extension. (CVE-2019-11697)
 
 It was discovered that history data could be exposed via drag and drop
 of hyperlinks to and from bookmarks. If a user were tricked in to dragging
 a specially crafted hyperlink to the bookmark toolbar or sidebar, and
 subsequently back in to the web content area, an attacker could
 potentially exploit this to obtain sensitive information. (CVE-2019-11698)
 
 A type confusion bug was discovered with object groups and UnboxedObjects.
 If a user were tricked in to opening a specially crafted website after
 enabling the UnboxedObjects feature, an attacker could potentially
 exploit this to bypass security checks. (CVE-2019-9816)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  firefox  67.0.1+build1-0ubuntu0.19.04.1

Ubuntu 18.10:
  firefox  67.0.1+build1-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
  firefox  67.0.1+build1-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  firefox  67.0.1+build1-0ubuntu0.16.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
  https://usn.ubuntu.com/3991-2
  https://usn.ubuntu.com/3991-1
  https://launchpad.net/bugs/1830096

Package Information:
 
https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.19.04.1
 
https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.18.10.1
 
https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.18.04.1
 
https://launchpad.net/ubuntu/+source/firefox/67.0.1+build1-0ubuntu0.16.04.1

USN-4008-3: Linux kernel (Xenial HWE) vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4008-3
June 07, 2019

linux-lts-xenial, linux-aws vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty

Details:

USN-4008-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.

Robert Święcki discovered that the Linux kernel did not properly apply
Address Space Layout Randomization (ASLR) in some situations for setuid elf
binaries. A local attacker could use this to improve the chances of
exploiting an existing vulnerability in a setuid elf binary.
(CVE-2019-11190)

It was discovered that a null pointer dereference vulnerability existed in
the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash). (CVE-2019-11810)

It was discovered that a race condition leading to a use-after-free existed
in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux
kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-11815)

Federico Manuel Bento discovered that the Linux kernel did not properly
apply Address Space Layout Randomization (ASLR) in some situations for
setuid a.out binaries. A local attacker could use this to improve the
chances of exploiting an existing vulnerability in a setuid a.out binary.
(CVE-2019-11191)

As a hardening measure, this update disables a.out support.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
linux-image-4.4.0-1045-aws 4.4.0-1045.48
linux-image-4.4.0-150-generic 4.4.0-150.176~14.04.1
linux-image-4.4.0-150-generic-lpae 4.4.0-150.176~14.04.1
linux-image-4.4.0-150-lowlatency 4.4.0-150.176~14.04.1
linux-image-aws 4.4.0.1045.46
linux-image-generic-lpae-lts-xenial 4.4.0.150.132
linux-image-generic-lts-xenial 4.4.0.150.132
linux-image-lowlatency-lts-xenial 4.4.0.150.132

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/4008-3
https://usn.ubuntu.com/4008-1
CVE-2019-11190, CVE-2019-11191, CVE-2019-11810, CVE-2019-11815

USN-4011-1: Jinja2 vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4011-1
June 06, 2019

jinja2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Jinja2.

Software Description:
- jinja2: small but fast and easy to use stand-alone template engine

Details:

Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)

Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
python-jinja2 2.10-1ubuntu0.19.04.1
python3-jinja2 2.10-1ubuntu0.19.04.1

Ubuntu 18.10:
python-jinja2 2.10-1ubuntu0.18.10.1
python3-jinja2 2.10-1ubuntu0.18.10.1

Ubuntu 18.04 LTS:
python-jinja2 2.10-1ubuntu0.18.04.1
python3-jinja2 2.10-1ubuntu0.18.04.1

Ubuntu 16.04 LTS:
python-jinja2 2.8-1ubuntu0.1
python3-jinja2 2.8-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4011-1
CVE-2016-10745, CVE-2019-10906

Package Information:
https://launchpad.net/ubuntu/+source/jinja2/2.10-1ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/jinja2/2.10-1ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/jinja2/2.10-1ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/jinja2/2.8-1ubuntu0.1

USN-4011-2: Jinja2 vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4011-2
June 06, 2019

jinja2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in Jinja2.

Software Description:
- jinja2: small but fast and easy to use stand-alone template engine

Details:

USN-4011-1 fixed several vulnerabilities in Jinja2. This update
provides the corresponding update for Ubuntu 12.04 ESM  and Ubuntu
14.04 ESM.

Original advisory details:

 Olivier Dony discovered that Jinja incorrectly handled str.format. An
 attacker could possibly use this issue to escape the sandbox.
 (CVE-2016-10745)

 Brian Welch discovered that Jinja incorrectly handled str.format_map.
 An attacker could possibly use this issue to escape the sandbox.
 (CVE-2019-10906)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
  python-jinja2 2.7.2-2ubuntu0.1~esm1
  python3-jinja2 2.7.2-2ubuntu0.1~esm1

Ubuntu 12.04 ESM:
  python-jinja2 2.6-1ubuntu0.2
  python3-jinja2 2.6-1ubuntu0.2

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/4011-2
  https://usn.ubuntu.com/4011-1
  CVE-2016-10745, CVE-2019-10906