The following updates has been released for Ubuntu Linux:

USN-3922-2: PHP vulnerabilities
USN-3951-1: Dovecot vulnerability
USN-3952-1: Pacemaker vulnerabilities
USN-3953-1: PHP vulnerabilities

USN-3922-2: PHP vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3922-2
April 23, 2019

php5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php5: HTML-embedded scripting language interpreter

Details:

USN-3922-1 fixed vulnerabilities in PHP. This update provides the
corresponding update for Ubuntu 14.04 LTS.

It was discovered that PHP incorrectly handled certain files. An
attacker could possibly use this issue to access sensitive information.
(CVE-2019-9022)

It was discovered that PHP incorrectly handled certain files. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-9675)

Original advisory details:

 It was discovered that PHP incorrectly handled certain inputs. An
 attacker could possibly use this issue to expose sensitive
 information. (CVE-2019-9637, CVE-2019-9638, CVE-2019-9639,
 CVE-2019-9640, CVE-2019-9641)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libapache2-mod-php 5.5.9+dfsg-1ubuntu4.29
  php5-cgi 5.5.9+dfsg-1ubuntu4.29
  php5-cli 5.5.9+dfsg-1ubuntu4.29
  php5-fpm 5.5.9+dfsg-1ubuntu4.29
  php5-xmlrpc 5.5.9+dfsg-1ubuntu4.29

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/usn/usn-3922-2
  https://usn.ubuntu.com/usn/usn-3922-1
  CVE-2019-9022, CVE-2019-9637, CVE-2019-9638, CVE-2019-9639,
  CVE-2019-9640, CVE-2019-9641, CVE-2019-9675

Package Information:
  https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.29

USN-3951-1: Dovecot vulnerability

==========================================================================
Ubuntu Security Notice USN-3951-1
April 23, 2019

dovecot vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10

Summary:

Dovecot could be made to crash if it received specially crafted network
traffic.

Software Description:
- dovecot: IMAP and POP3 email server

Details:

It was discovered that the Dovecot JSON encoder incorrectly handled certain
invalid UTF-8 characters. A remote attacker could possibly use this issue
to cause Dovecot to repeatedly crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
dovecot-core 1:2.3.4.1-1ubuntu2.1

Ubuntu 18.10:
dovecot-core 1:2.3.2.1-1ubuntu3.3

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3951-1
CVE-2019-10691

Package Information:
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.4.1-1ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.3.2.1-1ubuntu3.3

USN-3952-1: Pacemaker vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3952-1
April 23, 2019

pacemaker vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Pacemaker.

Software Description:
- pacemaker: Cluster resource manager

Details:

Jan Pokorný discovered that Pacemaker incorrectly handled client-server
authentication. A local attacker could possibly use this issue to escalate
privileges. (CVE-2018-16877)

Jan Pokorný discovered that Pacemaker incorrectly handled certain
verifications. A local attacker could possibly use this issue to cause a
denial of service. (CVE-2018-16878)

Jan Pokorný discovered that Pacemaker incorrectly handled certain memory
operations. A local attacker could possibly use this issue to obtain
sensitive information in log outputs. This issue only applied to Ubuntu
18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
pacemaker 1.1.18-2ubuntu1.19.04.1

Ubuntu 18.10:
pacemaker 1.1.18-2ubuntu1.18.10.1

Ubuntu 18.04 LTS:
pacemaker 1.1.18-0ubuntu1.1

Ubuntu 16.04 LTS:
pacemaker 1.1.14-2ubuntu1.6

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3952-1
CVE-2018-16877, CVE-2018-16878, CVE-2019-3885

Package Information:
https://launchpad.net/ubuntu/+source/pacemaker/1.1.18-2ubuntu1.19.04.1
https://launchpad.net/ubuntu/+source/pacemaker/1.1.18-2ubuntu1.18.10.1
https://launchpad.net/ubuntu/+source/pacemaker/1.1.18-0ubuntu1.1
https://launchpad.net/ubuntu/+source/pacemaker/1.1.14-2ubuntu1.6

USN-3953-1: PHP vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3953-1
April 23, 2019

php7.0, php7.2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain exif tags in JPEG
images. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
libapache2-mod-php7.2 7.2.17-0ubuntu0.19.04.1
php7.2-cgi 7.2.17-0ubuntu0.19.04.1
php7.2-cli 7.2.17-0ubuntu0.19.04.1
php7.2-fpm 7.2.17-0ubuntu0.19.04.1

Ubuntu 18.10:
libapache2-mod-php7.2 7.2.17-0ubuntu0.18.10.1
php7.2-cgi 7.2.17-0ubuntu0.18.10.1
php7.2-cli 7.2.17-0ubuntu0.18.10.1
php7.2-fpm 7.2.17-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
libapache2-mod-php7.2 7.2.17-0ubuntu0.18.04.1
php7.2-cgi 7.2.17-0ubuntu0.18.04.1
php7.2-cli 7.2.17-0ubuntu0.18.04.1
php7.2-fpm 7.2.17-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
libapache2-mod-php7.0 7.0.33-0ubuntu0.16.04.4
php7.0-cgi 7.0.33-0ubuntu0.16.04.4
php7.0-cli 7.0.33-0ubuntu0.16.04.4
php7.0-fpm 7.0.33-0ubuntu0.16.04.4

In Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04, this update uses a new
upstream release, which includes additional bug fixes.

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3953-1
CVE-2019-11034, CVE-2019-11035

Package Information:
https://launchpad.net/ubuntu/+source/php7.2/7.2.17-0ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/php7.2/7.2.17-0ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/php7.2/7.2.17-0ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/php7.0/7.0.33-0ubuntu0.16.04.4