[USN-3802-1] X.Org X server vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvTLM8ACgkQZWnYVadE
vpOb9g/7B5Q+d1t2fO6pW4afdsgQZBVA768HdpTXAVwE4tnaDecqrqgHuBNTqV0S
/fsQa93r1fhLcG3tEemsZZC7NkyJ+GodCQwokB9+bbTcg/FChQRw0CoW8+5v96+K
hVMEAjWuaAeUg92UP/+1nUqYai5ACGINCv5jOMhXk0EEvaaIuPyNoT2kO6tzeC0A
HsJQccoB2PBroLKlG2QHX7tdSsIhgr3HQo/8reuelzrKeTMav5ULjQVnjHowq4mm
5ryXNWQ+u7keWnFpmJG9DwMYPjYYa07WTWG0iN8D792cQY70UaiStKgG8drt06T1
bN1GbWH/lqkrotaLbTuQcabW5vA6AMlulhUJBfs44JJ/fG28owgahdyx6eDRKru1
VZiIrNmUiPhsNFjkVkrrEQXHJymnbMRxyJ0wcIvQLTAJHSUlG+OezpZAxDEoCU+m
29zYIm4HC5Ii+QNsHNzXJTTclayPln3OOIXpL+RjGNMbeMy+B2aRa3c0UTxmPiXc
7Hno7HyURwFgx3znSjL1Pv+Y4Um1JBCnnNXqIO2uYgBb6UKoKVjPG2sdzjNQs1mG
rWnfAoiDx6+1pHdjSEEdmEJOyayIXVIHcC3riU+o22cdkceEo0tsYTT5VIWrw0Xq
HKGhMKmrHkj5K/MatpN3kueqRpHYrKnVmpkj7e/sMPE5JkRLXLg=
=4UWW
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3802-1
October 26, 2018

xorg-server, xorg-server-hwe-16.04 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

X.Org X server could be made to overwrite files as the administrator.

Software Description:
- xorg-server: X.Org X11 server
- xorg-server-hwe-16.04: X.Org X11 server

Details:

Narendra Shinde discovered that the X.Org X server incorrectly handled
certain command line parameters when running as root with the legacy
wrapper. When certain graphics drivers are being used, a local attacker
could possibly use this issue to overwrite arbitrary files and escalate
privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
xserver-xorg-core 2:1.20.1-3ubuntu2.1

Ubuntu 18.04 LTS:
xserver-xorg-core 2:1.19.6-1ubuntu4.2

Ubuntu 16.04 LTS:
xserver-xorg-core-hwe-16.04 2:1.19.6-1ubuntu4.1~16.04.2

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3802-1
CVE-2018-14665

Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.1-3ubuntu2.1
https://launchpad.net/ubuntu/+source/xorg-server/2:1.19.6-1ubuntu4.2

https://launchpad.net/ubuntu/+source/xorg-server-hwe-16.04/2:1.19.6-1ubuntu4.1~16.04.2

仰叡承dxuzou718决策机制（决策团队、运作模式、支撑机制）

OpenBSD Errata: October 25th, 2018 (xserver)

Errata patches for Xorg have been released for OpenBSD 6.3 and 6.4.

The Xorg X server incorrectly validates certain options, allowing arbitrary
files to be overwritten.

Binary updates for the amd64, i386, and arm64 platforms are available
via the syspatch utility. Source code patches can be found on the
respective errata pages:

https://www.openbsd.org/errata63.html
https://www.openbsd.org/errata64.html

If the X server is running, restart it after patching.

As an immediate (temporary) workaround, the Xorg binary's setuid bit can be
removed by running: chmod u-s /usr/X11R6/bin/Xorg

[CentOS-announce] CESA-2018:3005 Critical CentOS 7 firefox Security Update

CentOS Errata and Security Advisory 2018:3005 Critical

Upstream details at : https://access.redhat.com/errata/RHSA-2018:3005

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
92725d2fa00529e327919f388a3f4feb777d7f07017249d1feae89b762d83f11 firefox-60.3.0-1.el7.centos.i686.rpm
be3a0170d5a7337c36503e94d4622e534ef6c98f9fe55f7f36487b37214de23e firefox-60.3.0-1.el7.centos.x86_64.rpm

Source:
458adf01f66b78338dc05bc6b12c78f060cc15dedd5a1c535d56c7f22d418a92 firefox-60.3.0-1.el7.centos.src.rpm



--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

[CentOS-announce] CEEA-2018:2984 CentOS 7 xorg-x11-server Enhancement Update

CentOS Errata and Enhancement Advisory 2018:2984

Upstream details at : https://access.redhat.com/errata/RHEA-2018:2984

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
4a9d8941e6cd3aa6466b1523f5070245e5dce2972268a5da22fc15fb20a06428 xorg-x11-server-1.19.5-5.1.el7_5.src.rpm
4d254146c3427137714cae08b8224a5fc85374adc0888b4b3f20770b142e2e1c xorg-x11-server-common-1.19.5-5.1.el7_5.x86_64.rpm
a1810d6cc11c4e871b63e4a39b0c6caa396b8b120f928d5f49e254bc351ae991 xorg-x11-server-devel-1.19.5-5.1.el7_5.i686.rpm
a6819e38b5ec6fad65365d346519fdb66d1268e2b19ac4684cad90523590a656 xorg-x11-server-devel-1.19.5-5.1.el7_5.x86_64.rpm
30f538ea7654fa7d5379e1089132accad9dab147bb8269713e162dcff71f40d5 xorg-x11-server-source-1.19.5-5.1.el7_5.noarch.rpm
55add998a8a2a71a746a5ab6b30fbb094671b7e6bb993d250dce62847c3cdc55 xorg-x11-server-Xdmx-1.19.5-5.1.el7_5.x86_64.rpm
e4e83bcb70a74993947a1ea81e81cf7ac10c08668d8492675c05d8d3940b82e2 xorg-x11-server-Xephyr-1.19.5-5.1.el7_5.x86_64.rpm
58b449d313ba09feb44ec06987a3e2493c5d0bbf610a8c1266e89c66db21e53e xorg-x11-server-Xnest-1.19.5-5.1.el7_5.x86_64.rpm
ebf00f996efd373978be3948b9df638a861e31ba2038b36613e26f0842d73cbe xorg-x11-server-Xorg-1.19.5-5.1.el7_5.x86_64.rpm
b6cfc8d98632119b15a92a22555736d25f6f896c05837f8ec89935318fb56666 xorg-x11-server-Xvfb-1.19.5-5.1.el7_5.x86_64.rpm
5b8614a5c1d5ede70235b0601e6fa884d1de94e30a1972b00e52f85e86a06df7 xorg-x11-server-Xwayland-1.19.5-5.1.el7_5.x86_64.rpm




--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

[CentOS-announce] CESA-2018:3006 Critical CentOS 6 firefox Security Update

CentOS Errata and Security Advisory 2018:3006 Critical

Upstream details at : https://access.redhat.com/errata/RHSA-2018:3006

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

i386:
5f403870421892ff828545d93b19bc94eeee03b4c16fa432712637ee5415b479 firefox-60.3.0-1.el6.centos.i686.rpm

x86_64:
5f403870421892ff828545d93b19bc94eeee03b4c16fa432712637ee5415b479 firefox-60.3.0-1.el6.centos.i686.rpm
f330418f88045fe41bff2ffe23b2cf4ac0ea9119f7ba3dc97f666adc5fe46964 firefox-60.3.0-1.el6.centos.x86_64.rpm

Source:
1d474a68ee15a8d2d6b5fd45b61dffadbdd0cc582eb45e17842d9dd4994e06c5 firefox-60.3.0-1.el6.centos.src.rpm



--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

Fedora 29 Final is GO

The Fedora 29 Final RC1.2 compose [1] is GO and will to be shipped
live on Tuesday, October 30, 2018.

For more information please check the Go/No-Go meeting minutes [2] or logs [3].

Thank you to everyone who has worked on this release.

[1] http://dl.fedoraproject.org/pub/alt/stage/29_RC-1.2/
[2] https://meetbot.fedoraproject.org/fedora-meeting-1/2018-10-25/f29-final-go_no_go-meeting.2018-10-25-17.03.html
[3] https://meetbot.fedoraproject.org/fedora-meeting-1/2018-10-25/f29-final-go_no_go-meeting.2018-10-25-17.03.log.html

--
Ben Cotton
Fedora Program Manager
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org

Issues with Google Chrome, PyCharm, Steam and other third-party repos in Fedora 29 prereleases

It was discovered[1] a short while ago that, due to a packaging
mistake in the fedora-workstation-repos package, upgrades from Fedora
28->Fedora 29 would replace the /etc/yum.repos.d/*.repo files provided
from that package with their default configuration.

What this meant in practice is that anyone who was using those
repositories in Fedora 28 would find them silently disabled in Fedora
29. In particular, this would mean that they might not notice that
they were not receiving updates, particularly (in the case of Chrome)
security updates.

This has been fixed for F29 Final, but if you have upgraded from
F28->F29 prior to today (such as at the Beta release), you should
check and verify that your expected repos are correctly enabled.

You can verify which repositories on your system are enabled or
disabled by running the command:
`dnf repolist --all`

If you discover that any of your expected repos have been disabled,
they can be re-enabled with:
`dnf config-manager --set-enabled <repo_name>`

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1640626
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org

[USN-3801-1] Firefox vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEERN//5MGgCOgyKeIFYR+97NWUbg8FAlvQxsMACgkQYR+97NWU
bg9JSggAqGILObzpchrqqN/zf6QQpPM9oIWLaGXRC2oiGncra3bpCfcQY+vtpc6z
C2KeJTsU9vfS71F4agpnpBUjvvJ6PE3TjVLB/KdJSsL5LeKYcowjU76BfuAY6wIa
6w0g2N7URCRtyzBw2pFyKHyqsVmwkUDZ9JhkFFF1CwedIoH6bvRuf/1suhYmXLGF
dAK9dQptk5Qdm5rnVbEW8xnotMrLkWwjppMDYIjie25ADea5qfl4eCHTsid2CcYa
Sovx+jv8wiTDNvt2sAUGLQuy7mV0CEd55D8yzGsDEFq5egV9sN8E6CKF9dt7tXkL
klyUhaC04iMBnSj/MYxIvtDG5zDhbQ==
=cetO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3801-1
October 24, 2018

firefox vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Firefox could be made to crash or run programs as your login if it
opened a malicious website.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, bypass CSP
restrictions, spoof the protocol registration notification bar, leak
SameSite cookies, bypass mixed content warnings, or execute arbitrary
code. (CVE-2018-12388, CVE-2018-12390, CVE-2018-12392, CVE-2018-12393,
CVE-2018-12398, CVE-2018-12399, CVE-2018-12401, CVE-2018-12402,
CVE-2018-12403)

Multiple security issues were discovered with WebExtensions in Firefox.
If a user were tricked in to installing a specially crafted extension, an
attacker could potentially exploit these to bypass domain restrictions,
gain additional privileges, or run content scripts in local pages without
permission. (CVE-2018-12395, CVE-2018-12396, CVE-2018-12397)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  firefox                         63.0+build2-0ubuntu0.18.10.2

Ubuntu 18.04 LTS:
  firefox                         63.0+build2-0ubuntu0.18.04.2

Ubuntu 16.04 LTS:
  firefox                         63.0+build2-0ubuntu0.16.04.2

Ubuntu 14.04 LTS:
  firefox                         63.0+build2-0ubuntu0.14.04.2

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
  https://usn.ubuntu.com/usn/usn-3801-1
  CVE-2018-12388, CVE-2018-12390, CVE-2018-12392, CVE-2018-12393,
  CVE-2018-12395, CVE-2018-12396, CVE-2018-12397, CVE-2018-12398,
  CVE-2018-12399, CVE-2018-12401, CVE-2018-12402, CVE-2018-12403

Package Information:
  https://launchpad.net/ubuntu/+source/firefox/63.0+build2-0ubuntu0.18.10.2
  https://launchpad.net/ubuntu/+source/firefox/63.0+build2-0ubuntu0.18.04.2
  https://launchpad.net/ubuntu/+source/firefox/63.0+build2-0ubuntu0.16.04.2
  https://launchpad.net/ubuntu/+source/firefox/63.0+build2-0ubuntu0.14.04.2

[USN-3800-1] audiofile vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3800-1
October 24, 2018

audiofile vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in audiofile.

Software Description:
- audiofile: Open-source version of the SGI audiofile library

Details:

It was discovered that audiofile incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-13440)

It was discovered that audiofile incorrectly handled certain files.
An attacker could possibly use this issue to  execute arbitrary code.
(CVE-2018-17095)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  audiofile-tools                 0.3.6-2ubuntu0.14.04.3
  libaudiofile1                   0.3.6-2ubuntu0.14.04.3

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/usn/usn-3800-1
  CVE-2018-13440, CVE-2018-17095

Package Information:
  https://launchpad.net/ubuntu/+source/audiofile/0.3.6-2ubuntu0.14.04.3

LibreSSL 2.8.2 Released

We would like to announce that we have released LibreSSL 2.8.2, which is
available in the LibreSSL directory of your local OpenBSD mirror. This
announcement comes a few days after it was first available on October
18th, 2018, along with OpenBSD 6.4. This is the first stable release from
the 2.8 series.

It includes the following changes from 2.8.1

* Added Wycheproof support for ECDH and ECDSA Web Crypto test vectors,
along with test harness fixes.

* Fixed memory leak in nc(1)

LibreSSL 2.8.2 also includes:

* Added Wycheproof support for ECDH, RSASSA-PSS, AES-GCM,
AES-CMAC, AES-CCM, AES-CBC-PKCS5, DSA, ChaCha20-Poly1305, ECDSA, and
X25519 test vectors. Applied appropriate fixes for errors uncovered by tests.

* Simplified key exchange signature generation and verification.

* Fixed a one-byte buffer overrun in callers of EVP_read_pw_string

* Converted more code paths to use CBB/CBS. All handshake messages are
now created by CBB.

* Fixed various memory leaks found by Coverity.

* Simplified session ticket parsing and handling, inspired by
BoringSSL.

* Modified signature of CRYPTO_mem_leaks_* to return -1. This function
is a no-op in LibreSSL, so this function returns an error to not
indicate the (non-)existence of memory leaks.

* SSL_copy_session_id, PEM_Sign, EVP_EncodeUpdate, BIO_set_cipher,
X509_OBJECT_up_ref_count now return an int for error handling,
matching OpenSSL.

* Converted a number of #defines into proper functions, matching
OpenSSL's ABI.

* Added X509_get0_serialNumber from OpenSSL.

* Removed EVP_PKEY2PKCS8_broken and PKCS8_set_broken, while adding
PKCS8_pkey_add1_attr_by_NID and PKCS8_pkey_get0_attrs, matching
OpenSSL.

* Removed broken pkcs8 formats from openssl(1).

* Converted more functions in public API to use const arguments.

* Stopped handing AES-GCM in ssl_cipher_get_evp, since they use the
EVP_AEAD interface.

* Stopped using composite EVP_CIPHER AEADs.

* Added timing-safe compares for checking results of signature
verification. There are no known attacks, this is just inexpensive
prudence.

* Correctly clear the current cipher state, when changing cipher state.
This fixed an issue where renegotiation of cipher suites would fail
when switched from AEAD to non-AEAD or vice-versa.
Issue reported by Bernard Spil.

* Added more cipher tests to appstest.sh, including all TLSv1.2
ciphers.

* Added RSA_meth_get_finish() RSA_meth_set1_name() from OpenSSL.

* Added new EVP_CIPHER_CTX_(get|set)_iv() API that allows the IV to be
retrieved and set with appropriate validation.

* Extensive documentation updates and additional API history.

* Fixed a pair of 20+ year-old bugs in X509_NAME_add_entry

* Tighten up checks for various X509_VERIFY_PARAM functions,
'poisoning' parameters so that an unverified certificate cannot be
used if it fails verification.

* Fixed a potential memory leak on failure in ASN1_item_digest

* Fixed a potential memory alignment crash in asn1_item_combine_free

* Removed unused SSL3_FLAGS_DELAY_CLIENT_FINISHED and
SSL3_FLAGS_POP_BUFFER flags in write path, simplifying IO paths.

* Removed SSL_OP_TLS_ROLLBACK_BUG buggy client workarounds.

* Made ENGINE_finish and ENGINE_free succeed on NULL and simplify callers
and matching OpenSSL behavior, rewrote ENGINE_* documentation.

* Added const annotations to many existing APIs from OpenSSL, making
interoperability easier for downstream applications.

* Fixed small timing side-channels in ecdsa_sign_setup and
dsa_sign_setup.

* Documented security pitfalls with BN_FLG_CONSTTIME and constant-time
operation of BN_* functions.

* Updated BN_clear to use explicit_bzero.

* Added a missing bounds check in c2i_ASN1_BIT_STRING.

* More CBS conversions, including simplifications to RSA key exchange,
and converted code to use dedicated buffers for secrets.

* Removed three remaining single DES cipher suites.

* Fixed a potential leak/incorrect return value in DSA signature
generation.

* Added a blinding value when generating DSA and ECDSA signatures, in
order to reduce the possibility of a side-channel attack leaking the
private key.

* Added ECC constant time scalar multiplication support.
From Billy Brumley and his team at Tampere University of Technology.

* Revised the implementation of RSASSA-PKCS1-v1_5 to match the
specification in RFC 8017. Based on an OpenSSL commit by David
Benjamin.

* Cleaned up BN_* implementations following changes made in OpenSSL by
Davide Galassi and others.

The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.

[USN-3799-1] MySQL vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvPfEYACgkQZWnYVadE
vpNmtA/9FhNru1FFI9i8Cd11izbxAyafUwH/Bfqhn7qBxwcrYMAofmgLcwF0zFQ/
wQZWpkVt1bxrbpL/E8F7YO3vibM7o/hj16MET97gHv/u6Tav3fCbhCrTSXxmqTYT
F2KMD8ZO/1tqIA/m1SVlFKpFBs1IX1H9NY9q9LDFsG1JlV7d2DMLQ9Tu4+gPaely
ohXBl0fO+ohT7mGKQlvekciPqInzaI/uY9CONi/z/f5O7ZiFqu76HLXgwF/PFvA2
v6fmGoTxhPGdJz0UX4wuKzUAtKRd8jw3QGWMJaXV4C0Hf0TQq/B/q8enc6JzBj0Q
sESVapNYoHMb+DT940TAntrUie3dw4yqg39cSVuQcYSdfim2RlJFf+d8BZcPDGDr
1VTj/5PyaKhg3l5TSSqJSrSuT/qhYyYlKgH0kysmJJ2vOCghfYo/uLqNXwaYz4Sa
8mZhs/dDi66u5bSv3ogjzRY2fzYQlBy0/QlHr/Hr8ENiKanvkNVFqMTwBlM35oXa
y7xZzpaTY+JB71G5LVh3xQjIDNQBFxwRuR9f8u2N5rElxaEhzZRO/jzWk/Rrv7fn
L4zoXuB+D64DkPx3TWG4M16+kq2MxOtDAFi4sIFYc84eqIfPVE3JzaoQv0+GnW70
4S7j94F+ll7lrrlCro/PnvVbzg0su1cS/JjoEfL7yp8zzkTSVTI=
=d5Rr
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3799-1
October 23, 2018

mysql-5.5, mysql-5.7 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in MySQL.

Software Description:
- mysql-5.7: MySQL database
- mysql-5.5: MySQL database

Details:

Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.62 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 18.10 have been updated to MySQL 5.7.24.

In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-24.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
mysql-server-5.7 5.7.24-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
mysql-server-5.7 5.7.24-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
mysql-server-5.7 5.7.24-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.62-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3799-1
CVE-2018-3133, CVE-2018-3143, CVE-2018-3144, CVE-2018-3155,
CVE-2018-3156, CVE-2018-3161, CVE-2018-3162, CVE-2018-3171,
CVE-2018-3173, CVE-2018-3174, CVE-2018-3185, CVE-2018-3187,
CVE-2018-3200, CVE-2018-3247, CVE-2018-3251, CVE-2018-3276,
CVE-2018-3277, CVE-2018-3278, CVE-2018-3282, CVE-2018-3283,
CVE-2018-3284

Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.7/5.7.24-0ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/mysql-5.7/5.7.24-0ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/mysql-5.7/5.7.24-0ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.62-0ubuntu0.14.04.1