Updated PostgreSQL and Linux Kernel packages has been released for Ubuntu Linux:

USN-3818-1: PostgreSQL vulnerability
USN-3819-1: Linux kernel vulnerability
USN-3820-1: Linux kernel vulnerabilities
USN-3820-2: Linux kernel (HWE) vulnerabilities
USN-3820-3: Linux kernel (Azure) vulnerabilities
USN-3821-1: Linux kernel vulnerabilities
USN-3821-2: Linux kernel (Xenial HWE) vulnerabilities
USN-3822-1: Linux kernel vulnerabilities
USN-3822-2: Linux kernel (Trusty HWE) vulnerabilities
USN-3823-1: Linux kernel vulnerabilities

USN-3818-1: PostgreSQL vulnerability

==========================================================================
Ubuntu Security Notice USN-3818-1
November 14, 2018

postgresql-10 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS

Summary:

PostgreSQL could be made to run SQL statements as the administrator.

Software Description:
- postgresql-10: Object-relational SQL database

Details:

It was discovered that PostgreSQL incorrectly handled certain trigger
definitions when running pg_upgrade or pg_dump. A remote attacker could
possibly use this issue to execute arbitrary SQL statements with superuser
privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
postgresql-10 10.6-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
postgresql-10 10.6-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3818-1
CVE-2018-16850

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-10/10.6-0ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/postgresql-10/10.6-0ubuntu0.18.04.1

USN-3819-1: Linux kernel vulnerability

=========================================================================
Ubuntu Security Notice USN-3819-1
November 14, 2018

linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10

Summary:

The system could be made to crash or run programs as an administrator.

Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2

Details:

Felix Wilhelm discovered that the Xen netback driver in the Linux kernel
did not properly perform input validation in some situations. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
linux-image-4.18.0-1003-gcp 4.18.0-1003.4
linux-image-4.18.0-1004-aws 4.18.0-1004.5
linux-image-4.18.0-1004-kvm 4.18.0-1004.4
linux-image-4.18.0-1006-raspi2 4.18.0-1006.8
linux-image-4.18.0-11-generic 4.18.0-11.12
linux-image-4.18.0-11-generic-lpae 4.18.0-11.12
linux-image-4.18.0-11-lowlatency 4.18.0-11.12
linux-image-4.18.0-11-snapdragon 4.18.0-11.12
linux-image-aws 4.18.0.1004.4
linux-image-gcp 4.18.0.1003.3
linux-image-generic 4.18.0.11.12
linux-image-generic-lpae 4.18.0.11.12
linux-image-gke 4.18.0.1003.3
linux-image-kvm 4.18.0.1004.4
linux-image-lowlatency 4.18.0.11.12
linux-image-raspi2 4.18.0.1006.3
linux-image-snapdragon 4.18.0.11.12

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3819-1
CVE-2018-15471

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.18.0-11.12
https://launchpad.net/ubuntu/+source/linux-aws/4.18.0-1004.5
https://launchpad.net/ubuntu/+source/linux-gcp/4.18.0-1003.4
https://launchpad.net/ubuntu/+source/linux-kvm/4.18.0-1004.4
https://launchpad.net/ubuntu/+source/linux-raspi2/4.18.0-1006.8

USN-3820-1: Linux kernel vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3820-1
November 14, 2018

linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm: Linux kernel for cloud environments
- linux-oem: Linux kernel for OEM processors
- linux-raspi2: Linux kernel for Raspberry Pi 2

Details:

Felix Wilhelm discovered that the Xen netback driver in the Linux kernel
did not properly perform input validation in some situations. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-15471)

It was discovered that the generic SCSI driver in the Linux kernel did not
properly enforce permissions on kernel memory access. A local attacker
could use this to expose sensitive information or possibly elevate
privileges. (CVE-2017-13168)

It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)

It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
linux-image-4.15.0-1024-gcp 4.15.0-1024.25
linux-image-4.15.0-1026-kvm 4.15.0-1026.26
linux-image-4.15.0-1026-oem 4.15.0-1026.31
linux-image-4.15.0-1027-aws 4.15.0-1027.27
linux-image-4.15.0-1028-raspi2 4.15.0-1028.30
linux-image-4.15.0-1031-azure 4.15.0-1031.32
linux-image-4.15.0-39-generic 4.15.0-39.42
linux-image-4.15.0-39-generic-lpae 4.15.0-39.42
linux-image-4.15.0-39-lowlatency 4.15.0-39.42
linux-image-4.15.0-39-snapdragon 4.15.0-39.42
linux-image-aws 4.15.0.1027.27
linux-image-azure 4.15.0.1031.31
linux-image-gcp 4.15.0.1024.26
linux-image-generic 4.15.0.39.41
linux-image-generic-lpae 4.15.0.39.41
linux-image-gke 4.15.0.1024.26
linux-image-kvm 4.15.0.1026.26
linux-image-lowlatency 4.15.0.39.41
linux-image-oem 4.15.0.1026.31
linux-image-raspi2 4.15.0.1028.26
linux-image-snapdragon 4.15.0.39.41

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3820-1
CVE-2017-13168, CVE-2018-15471, CVE-2018-16658, CVE-2018-9363

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.15.0-39.42
https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1027.27
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1031.32
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1024.25
https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1026.26
https://launchpad.net/ubuntu/+source/linux-oem/4.15.0-1026.31
https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1028.30

USN-3820-2: Linux kernel (HWE) vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3820-2
November 14, 2018

linux-hwe, linux-azure, linux-gcp vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe: Linux hardware enablement (HWE) kernel

Details:

USN-3820-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.

Felix Wilhelm discovered that the Xen netback driver in the Linux kernel
did not properly perform input validation in some situations. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-15471)

It was discovered that the generic SCSI driver in the Linux kernel did not
properly enforce permissions on kernel memory access. A local attacker
could use this to expose sensitive information or possibly elevate
privileges. (CVE-2017-13168)

It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)

It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
linux-image-4.15.0-1024-gcp 4.15.0-1024.25~16.04.2
linux-image-4.15.0-1031-azure 4.15.0-1031.32~16.04.1
linux-image-4.15.0-39-generic 4.15.0-39.42~16.04.1
linux-image-4.15.0-39-generic-lpae 4.15.0-39.42~16.04.1
linux-image-4.15.0-39-lowlatency 4.15.0-39.42~16.04.1
linux-image-azure 4.15.0.1031.36
linux-image-gcp 4.15.0.1024.38
linux-image-generic-hwe-16.04 4.15.0.39.62
linux-image-generic-lpae-hwe-16.04 4.15.0.39.62
linux-image-gke 4.15.0.1024.38
linux-image-lowlatency-hwe-16.04 4.15.0.39.62
linux-image-oem 4.15.0.39.62

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3820-2
https://usn.ubuntu.com/usn/usn-3820-1
CVE-2017-13168, CVE-2018-15471, CVE-2018-16658, CVE-2018-9363

Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1031.32~16.04.1
https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1024.25~16.04.2
https://launchpad.net/ubuntu/+source/linux-hwe/4.15.0-39.42~16.04.1

USN-3820-3: Linux kernel (Azure) vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3820-3
November 14, 2018

linux-azure vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems

Details:

Felix Wilhelm discovered that the Xen netback driver in the Linux kernel
did not properly perform input validation in some situations. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-15471)

It was discovered that the generic SCSI driver in the Linux kernel did not
properly enforce permissions on kernel memory access. A local attacker
could use this to expose sensitive information or possibly elevate
privileges. (CVE-2017-13168)

It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)

It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-4.15.0-1031-azure 4.15.0-1031.32~14.04.1+signed1
linux-image-azure 4.15.0.1031.18

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3820-3
https://usn.ubuntu.com/usn/usn-3820-1
CVE-2017-13168, CVE-2018-15471, CVE-2018-16658, CVE-2018-9363

Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1031.32~14.04.1

USN-3821-1: Linux kernel vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3821-1
November 14, 2018

linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors

Details:

Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly ensure that xattr information remained in inode
bodies. An attacker could use this to construct a malicious ext4 image
that, when mounted, could cause a denial of service (system crash).
(CVE-2018-10880)

It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)

Wen Xu discovered that the f2fs filesystem implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13096)

Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem
implementation in the Linux kernel did not properly handle relocations in
some situations. An attacker could use this to construct a malicious btrfs
image that, when mounted, could cause a denial of service (system crash).
(CVE-2018-14609)

Wen Xu discovered that the HFS+ filesystem implementation in the Linux
kernel did not properly handle malformed catalog data in some situations.
An attacker could use this to construct a malicious HFS+ image that, when
mounted, could cause a denial of service (system crash). (CVE-2018-14617)

Jann Horn discovered that the procfs file system implementation in the
Linux kernel did not properly restrict the ability to inspect the kernel
stack of an arbitrary task. A local attacker could use this to expose
sensitive information. (CVE-2018-17972)

It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle some ioctls. An attacker with the
privilege to create KVM-based virtual machines could use this to cause a
denial of service (host system crash) or execute arbitrary code in the
host. (CVE-2018-18021)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
linux-image-4.4.0-1037-kvm 4.4.0-1037.43
linux-image-4.4.0-1072-aws 4.4.0-1072.82
linux-image-4.4.0-1100-raspi2 4.4.0-1100.108
linux-image-4.4.0-1104-snapdragon 4.4.0-1104.109
linux-image-4.4.0-139-generic 4.4.0-139.165
linux-image-4.4.0-139-generic-lpae 4.4.0-139.165
linux-image-4.4.0-139-lowlatency 4.4.0-139.165
linux-image-4.4.0-139-powerpc-e500mc 4.4.0-139.165
linux-image-4.4.0-139-powerpc-smp 4.4.0-139.165
linux-image-4.4.0-139-powerpc64-emb 4.4.0-139.165
linux-image-4.4.0-139-powerpc64-smp 4.4.0-139.165
linux-image-aws 4.4.0.1072.74
linux-image-generic 4.4.0.139.145
linux-image-generic-lpae 4.4.0.139.145
linux-image-kvm 4.4.0.1037.36
linux-image-lowlatency 4.4.0.139.145
linux-image-powerpc-e500mc 4.4.0.139.145
linux-image-powerpc-smp 4.4.0.139.145
linux-image-powerpc64-emb 4.4.0.139.145
linux-image-powerpc64-smp 4.4.0.139.145
linux-image-raspi2 4.4.0.1100.100
linux-image-snapdragon 4.4.0.1104.96

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3821-1
CVE-2018-10880, CVE-2018-13053, CVE-2018-13096, CVE-2018-14609,
CVE-2018-14617, CVE-2018-17972, CVE-2018-18021

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-139.165
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1072.82
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1037.43
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1100.108
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1104.109

USN-3821-2: Linux kernel (Xenial HWE) vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3821-2
November 14, 2018

linux-lts-xenial, linux-aws vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty

Details:

USN-3821-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.

Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly ensure that xattr information remained in inode
bodies. An attacker could use this to construct a malicious ext4 image
that, when mounted, could cause a denial of service (system crash).
(CVE-2018-10880)

It was discovered that the alarmtimer implementation in the Linux kernel
contained an integer overflow vulnerability. A local attacker could use
this to cause a denial of service. (CVE-2018-13053)

Wen Xu discovered that the f2fs filesystem implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13096)

Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem
implementation in the Linux kernel did not properly handle relocations in
some situations. An attacker could use this to construct a malicious btrfs
image that, when mounted, could cause a denial of service (system crash).
(CVE-2018-14609)

Wen Xu discovered that the HFS+ filesystem implementation in the Linux
kernel did not properly handle malformed catalog data in some situations.
An attacker could use this to construct a malicious HFS+ image that, when
mounted, could cause a denial of service (system crash). (CVE-2018-14617)

Jann Horn discovered that the procfs file system implementation in the
Linux kernel did not properly restrict the ability to inspect the kernel
stack of an arbitrary task. A local attacker could use this to expose
sensitive information. (CVE-2018-17972)

It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle some ioctls. An attacker with the
privilege to create KVM-based virtual machines could use this to cause a
denial of service (host system crash) or execute arbitrary code in the
host. (CVE-2018-18021)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-4.4.0-1034-aws 4.4.0-1034.37
linux-image-4.4.0-139-generic 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-generic-lpae 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-lowlatency 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-powerpc-e500mc 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-powerpc-smp 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-powerpc64-emb 4.4.0-139.165~14.04.1
linux-image-4.4.0-139-powerpc64-smp 4.4.0-139.165~14.04.1
linux-image-aws 4.4.0.1034.34
linux-image-generic-lpae-lts-xenial 4.4.0.139.119
linux-image-generic-lts-xenial 4.4.0.139.119
linux-image-lowlatency-lts-xenial 4.4.0.139.119
linux-image-powerpc-e500mc-lts-xenial 4.4.0.139.119
linux-image-powerpc-smp-lts-xenial 4.4.0.139.119
linux-image-powerpc64-emb-lts-xenial 4.4.0.139.119
linux-image-powerpc64-smp-lts-xenial 4.4.0.139.119

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3821-2
https://usn.ubuntu.com/usn/usn-3821-1
CVE-2018-10880, CVE-2018-13053, CVE-2018-13096, CVE-2018-14609,
CVE-2018-14617, CVE-2018-17972, CVE-2018-18021

Package Information:
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1034.37
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-139.165~14.04.1

USN-3822-1: Linux kernel vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3822-1
November 14, 2018

linux vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux: Linux kernel

Details:

Jim Mattson discovered that the KVM implementation in the Linux kernel
mismanages the #BP and #OF exceptions. A local attacker in a guest virtual
machine could use this to cause a denial of service (guest OS crash).
(CVE-2016-9588)

It was discovered that the generic SCSI driver in the Linux kernel did not
properly enforce permissions on kernel memory access. A local attacker
could use this to expose sensitive information or possibly elevate
privileges. (CVE-2017-13168)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not
properly validate device descriptors. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2017-16649)

It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)

It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-162-generic 3.13.0-162.212
linux-image-3.13.0-162-generic-lpae 3.13.0-162.212
linux-image-3.13.0-162-lowlatency 3.13.0-162.212
linux-image-3.13.0-162-powerpc-e500 3.13.0-162.212
linux-image-3.13.0-162-powerpc-e500mc 3.13.0-162.212
linux-image-3.13.0-162-powerpc-smp 3.13.0-162.212
linux-image-3.13.0-162-powerpc64-emb 3.13.0-162.212
linux-image-3.13.0-162-powerpc64-smp 3.13.0-162.212
linux-image-generic 3.13.0.162.172
linux-image-generic-lpae 3.13.0.162.172
linux-image-lowlatency 3.13.0.162.172
linux-image-powerpc-e500 3.13.0.162.172
linux-image-powerpc-e500mc 3.13.0.162.172
linux-image-powerpc-smp 3.13.0.162.172
linux-image-powerpc64-emb 3.13.0.162.172
linux-image-powerpc64-smp 3.13.0.162.172

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3822-1
CVE-2016-9588, CVE-2017-13168, CVE-2017-16649, CVE-2018-16658,
CVE-2018-9363

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-162.212

USN-3822-2: Linux kernel (Trusty HWE) vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3822-2
November 14, 2018

linux-lts-trusty vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise ESM

Details:

USN-3822-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.

Jim Mattson discovered that the KVM implementation in the Linux kernel
mismanages the #BP and #OF exceptions. A local attacker in a guest virtual
machine could use this to cause a denial of service (guest OS crash).
(CVE-2016-9588)

It was discovered that the generic SCSI driver in the Linux kernel did not
properly enforce permissions on kernel memory access. A local attacker
could use this to expose sensitive information or possibly elevate
privileges. (CVE-2017-13168)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not
properly validate device descriptors. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2017-16649)

It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)

It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
linux-image-3.13.0-162-generic 3.13.0-162.212~precise1
linux-image-3.13.0-162-generic-lpae 3.13.0-162.212~precise1
linux-image-generic-lpae-lts-trusty 3.13.0.162.152
linux-image-generic-lts-trusty 3.13.0.162.152

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3822-2
https://usn.ubuntu.com/usn/usn-3822-1
CVE-2016-9588, CVE-2017-13168, CVE-2017-16649, CVE-2018-16658,
CVE-2018-9363

USN-3823-1: Linux kernel vulnerabilities

=========================================================================
Ubuntu Security Notice USN-3823-1
November 15, 2018

linux vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 ESM

Summary:

Several security issues were mitigated in the Linux kernel.

Software Description:
- linux: Linux kernel

Details:

It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker in a guest virtual machine could use this to expose sensitive
information (memory from other guests or the host OS). (CVE-2018-3646)

It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker could use this to expose sensitive information (memory from the
kernel or other processes). (CVE-2018-3620)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
linux-image-3.2.0-137-generic 3.2.0-137.183
linux-image-3.2.0-137-generic-pae 3.2.0-137.183
linux-image-3.2.0-137-highbank 3.2.0-137.183
linux-image-3.2.0-137-omap 3.2.0-137.183
linux-image-3.2.0-137-powerpc-smp 3.2.0-137.183
linux-image-3.2.0-137-powerpc64-smp 3.2.0-137.183
linux-image-3.2.0-137-virtual 3.2.0-137.183
linux-image-generic 3.2.0.137.152
linux-image-generic-pae 3.2.0.137.152
linux-image-highbank 3.2.0.137.152
linux-image-omap 3.2.0.137.152
linux-image-powerpc 3.2.0.137.152
linux-image-powerpc-smp 3.2.0.137.152
linux-image-powerpc64-smp 3.2.0.137.152
linux-image-virtual 3.2.0.137.152

Please note that the recommended mitigation for CVE-2018-3646 involves
updating processor microcode in addition to updating the kernel;
however, the kernel includes a fallback for processors that have not
received microcode updates.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3823-1
CVE-2018-3620, CVE-2018-3646,
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF