The following updates has been released for Ubuntu Linux:

USN-3831-2: Ghostscript regression
USN-3839-1: WavPack vulnerabilities
USN-3840-1: OpenSSL vulnerabilities

USN-3831-2: Ghostscript regression

==========================================================================
Ubuntu Security Notice USN-3831-2
December 06, 2018

ghostscript regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

USN-3831-1 introduced a regression in Ghostscript.

Software Description:
- ghostscript: PostScript and PDF interpreter

Details:

USN-3831-1 fixed vulnerabilities in Ghostscript. Ghostscript 9.26
introduced a regression when used with certain options. This update fixes
the problem.

Original advisory details:

It was discovered that Ghostscript contained multiple security issues. If a
user or automated system were tricked into processing a specially crafted
file, a remote attacker could possibly use these issues to access arbitrary
files, execute arbitrary code, or cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
ghostscript 9.26~dfsg+0-0ubuntu0.18.10.3
libgs9 9.26~dfsg+0-0ubuntu0.18.10.3

Ubuntu 18.04 LTS:
ghostscript 9.26~dfsg+0-0ubuntu0.18.04.3
libgs9 9.26~dfsg+0-0ubuntu0.18.04.3

Ubuntu 16.04 LTS:
ghostscript 9.26~dfsg+0-0ubuntu0.16.04.3
libgs9 9.26~dfsg+0-0ubuntu0.16.04.3

Ubuntu 14.04 LTS:
ghostscript 9.26~dfsg+0-0ubuntu0.14.04.3
libgs9 9.26~dfsg+0-0ubuntu0.14.04.3

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3831-2
https://usn.ubuntu.com/usn/usn-3831-1
https://launchpad.net/bugs/1806517

Package Information:
https://launchpad.net/ubuntu/+source/ghostscript/9.26~dfsg+0-0ubuntu0.18.10.3
https://launchpad.net/ubuntu/+source/ghostscript/9.26~dfsg+0-0ubuntu0.18.04.3
https://launchpad.net/ubuntu/+source/ghostscript/9.26~dfsg+0-0ubuntu0.16.04.3
https://launchpad.net/ubuntu/+source/ghostscript/9.26~dfsg+0-0ubuntu0.14.04.3

USN-3839-1: WavPack vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3839-1
December 06, 2018

wavpack vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in WavPack.

Software Description:
- wavpack: audio codec (lossy and lossless) - encoder and decoder

Details:

It was discovered that WavPack incorrectly handled certain WAV files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-19840, CVE-2018-19841)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
libwavpack1 5.1.0-4ubuntu0.1
wavpack 5.1.0-4ubuntu0.1

Ubuntu 18.04 LTS:
libwavpack1 5.1.0-2ubuntu1.2
wavpack 5.1.0-2ubuntu1.2

Ubuntu 16.04 LTS:
libwavpack1 4.75.2-2ubuntu0.2
wavpack 4.75.2-2ubuntu0.2

Ubuntu 14.04 LTS:
libwavpack1 4.70.0-1ubuntu0.2
wavpack 4.70.0-1ubuntu0.2

In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/usn/usn-3839-1
CVE-2018-19840, CVE-2018-19841

Package Information:
https://launchpad.net/ubuntu/+source/wavpack/5.1.0-4ubuntu0.1
https://launchpad.net/ubuntu/+source/wavpack/5.1.0-2ubuntu1.2
https://launchpad.net/ubuntu/+source/wavpack/4.75.2-2ubuntu0.2
https://launchpad.net/ubuntu/+source/wavpack/4.70.0-1ubuntu0.2

USN-3840-1: OpenSSL vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3840-1
December 06, 2018

openssl, openssl1.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An
attacker could possibly use this issue to perform a timing side-channel
attack and recover private DSA keys. (CVE-2018-0734)

Samuel Weiser discovered that OpenSSL incorrectly handled ECDSA signing. An
attacker could possibly use this issue to perform a timing side-channel
attack and recover private ECDSA keys. This issue only affected Ubuntu
18.04 LTS and Ubuntu 18.10. (CVE-2018-0735)

Billy Bob Brumley, Cesar Pereida Garcia, Sohaib ul Hassan, Nicola Tuveri,
and Alejandro Cabrera Aldaya discovered that Simultaneous Multithreading
(SMT) architectures are vulnerable to side-channel leakage. This issue is
known as "PortSmash". An attacker could possibly use this issue to perform
a timing side-channel attack and recover private keys. (CVE-2018-5407)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
libssl1.0.0 1.0.2n-1ubuntu6.1
libssl1.1 1.1.1-1ubuntu2.1

Ubuntu 18.04 LTS:
libssl1.0.0 1.0.2n-1ubuntu5.2
libssl1.1 1.1.0g-2ubuntu4.3

Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.14

Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.27

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3840-1
CVE-2018-0734, CVE-2018-0735, CVE-2018-5407

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.1
https://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu6.1
https://launchpad.net/ubuntu/+source/openssl/1.1.0g-2ubuntu4.3
https://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu5.2
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.14
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.27