The following updates has been released for Ubuntu Linux:

USN-3675-2: GnuPG 2 vulnerability
USN-3678-4: Linux kernel (Raspberry Pi 2) vulnerabilities
USN-3685-1: Ruby vulnerabilities
USN-3686-1: file vulnerabilities

USN-3675-2: GnuPG 2 vulnerability

=========================================================================
Ubuntu Security Notice USN-3675-2
June 15, 2018

gnupg2 vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

GnuPG 2 could be made to present validity information incorrectly.

Software Description:
- gnupg2: GNU privacy guard - a free PGP replacement

Details:

USN-3675-1 fixed a vulnerability in GnuPG 2 for Ubuntu 18.04 LTS and
Ubuntu 17.10. This update provides the corresponding update for GnuPG 2
in Ubuntu 16.04 LTS and Ubuntu 14.04 LTS.

Original advisory details:

Marcus Brinkmann discovered that during decryption or verification,
GnuPG did not properly filter out terminal sequences when reporting the
original filename. An attacker could use this to specially craft a file
that would cause an application parsing GnuPG output to incorrectly
interpret the status of the cryptographic operation reported by GnuPG.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
gnupg2 2.1.11-6ubuntu2.1

Ubuntu 14.04 LTS:
gnupg2 2.0.22-3ubuntu1.4

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3675-2
https://usn.ubuntu.com/usn/usn-3675-1
CVE-2018-12020

Package Information:
https://launchpad.net/ubuntu/+source/gnupg2/2.1.11-6ubuntu2.1
https://launchpad.net/ubuntu/+source/gnupg2/2.0.22-3ubuntu1.4

USN-3678-4: Linux kernel (Raspberry Pi 2) vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3678-4
June 15, 2018

linux-raspi2 vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-raspi2: Linux kernel for Raspberry Pi 2

Details:

Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly handle corrupted meta data in some situations. An
attacker could use this to specially craft an ext4 file system that caused
a denial of service (system crash) when mounted. (CVE-2018-1092)

It was discovered that the 802.11 software simulator implementation in the
Linux kernel contained a memory leak when handling certain error
conditions. A local attacker could possibly use this to cause a denial of
service (memory exhaustion). (CVE-2018-8087)

It was discovered that a memory leak existed in the Serial Attached SCSI
(SAS) implementation in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (memory exhaustion).
(CVE-2018-10021)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
linux-image-4.15.0-1012-raspi2 4.15.0-1012.13
linux-image-raspi2 4.15.0.1012.10

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3678-4
https://usn.ubuntu.com/usn/usn-3678-1
CVE-2018-10021, CVE-2018-1092, CVE-2018-8087

Package Information:
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1012.13

USN-3685-1: Ruby vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3685-1
June 13, 2018

ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Ruby.

Software Description:
- ruby2.3: Object-oriented scripting language
- ruby1.9.1: Object-oriented scripting language
- ruby2.0: Object-oriented scripting language

Details:

Some of these CVE were already addressed in previous
USN: 3439-1, 3553-1, 3528-1. Here we address for
the remain releases.

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a buffer overrun. (CVE-2017-0898)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to overwrite any file on the filesystem.
(CVE-2017-0901)

It was discovered that Ruby was vulnerable to a DNS hijacking
vulnerability. An attacker could use this to possibly force the
RubyGems client to download and install gems from a server that the
attacker controls.  (CVE-2017-0902)

It was discovered that Ruby incorrectly handled certain YAML files.
An attacker could use this to possibly execute arbitrary code. 
(CVE-2017-0903)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to expose sensitive information.
(CVE-2017-14064)

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code. (CVE-2017-10784)

It was discovered that Ruby incorrectly handled certain network
requests. An attacker could possibly use this to inject a crafted key
into a HTTP response. (CVE-2017-17742)

It was discovered that Ruby incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
This update is only addressed to ruby2.0. (CVE-2018-1000074)

It was discovered that Ruby incorrectly handled certain network
requests. An attacker could possibly use this to cause a denial of
service. (CVE-2018-8777)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  libruby2.3 2.3.3-1ubuntu1.6
  ruby2.3 2.3.3-1ubuntu1.6

Ubuntu 16.04 LTS:
  libruby2.3 2.3.1-2~16.04.10
  ruby2.3 2.3.1-2~16.04.10

Ubuntu 14.04 LTS:
  libruby1.9.1 1.9.3.484-2ubuntu1.12
  libruby2.0 2.0.0.484-1ubuntu2.10
  ruby1.9.1 1.9.3.484-2ubuntu1.12
  ruby1.9.3 1.9.3.484-2ubuntu1.12
  ruby2.0 2.0.0.484-1ubuntu2.10

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/usn/usn-3685-1
  CVE-2017-0898, CVE-2017-0901, CVE-2017-0902, CVE-2017-0903,
  CVE-2017-10784, CVE-2017-14064, CVE-2017-17742, CVE-2018-1000074,
  CVE-2018-8777

Package Information:
  https://launchpad.net/ubuntu/+source/ruby2.3/2.3.3-1ubuntu1.6
  https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~16.04.10
  https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.12
  https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.10

USN-3686-1: file vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3686-1
June 14, 2018

file vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in file.

Software Description:
- file: Tool to determine file types

Details:

Alexander Cherepanov discovered that file incorrectly handled a large
number of notes. An attacker could use this issue to cause a denial of
service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

Alexander Cherepanov discovered that file incorrectly handled certain long
strings. An attacker could use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

Alexander Cherepanov discovered that file incorrectly handled certain
malformed ELF files. An attacker could use this issue to cause a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS. (CVE-2014-9653)

It was discovered that file incorrectly handled certain magic files. An
attacker could use this issue with a specially crafted magic file to cause
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 14.04 LTS. (CVE-2015-8865)

It was discovered that file incorrectly handled certain malformed ELF
files. An attacker could use this issue to cause a denial of service.
(CVE-2018-10360)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
file 1:5.32-2ubuntu0.1
libmagic1 1:5.32-2ubuntu0.1

Ubuntu 17.10:
file 1:5.32-1ubuntu0.1
libmagic1 1:5.32-1ubuntu0.1

Ubuntu 16.04 LTS:
file 1:5.25-2ubuntu1.1
libmagic1 1:5.25-2ubuntu1.1

Ubuntu 14.04 LTS:
file 1:5.14-2ubuntu3.4
libmagic1 1:5.14-2ubuntu3.4

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3686-1
CVE-2014-9620, CVE-2014-9621, CVE-2014-9653, CVE-2015-8865,
CVE-2018-10360

Package Information:
https://launchpad.net/ubuntu/+source/file/1:5.32-2ubuntu0.1
https://launchpad.net/ubuntu/+source/file/1:5.32-1ubuntu0.1
https://launchpad.net/ubuntu/+source/file/1:5.25-2ubuntu1.1
https://launchpad.net/ubuntu/+source/file/1:5.14-2ubuntu3.4