Skip to main content
  1. Blog
  2. Article

Robbie
on 13 May 2015

Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED]

A buffer overflow in the virtual floppy disk controller of QEMU has been discovered. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process.

This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an AppArmor profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment’s attack surface.

A fix for this issue has been committed in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. To address the issue, ensure that qemu-kvm 1.0+noroms-0ubuntu14.22 (Ubuntu 12.04 LTS), qemu 2.0.0+dfsg-2ubuntu1.11 (Ubuntu 14.04 LTS), qemu 2.1+dfsg-4ubuntu6.6 (Ubuntu 14.10), qemu 1:2.2+dfsg-5expubuntu9.1 (Ubuntu 15.04) are installed.

For reference, the Ubuntu Security Notices website is the best place to find information on security updates and the affected supported releases of Ubuntu.  Users can get notifications via email and RSS feeds from the USN site, as well as access the Ubuntu CVE Tracker.

Related posts

Isobel Kate Maxwell
13 February 2026

The foundations of software: open source libraries and their maintainers

Community Article

Open source libraries are repositories of code that developers can use and, depending on the license, contribute to, modify, and redistribute. Open source libraries are usually developed on a platform like GitHub, and distributed using package registries like PyPI for Python and npm for JavaScript. These repositories contain pre-written, ...

Miguel Divo
13 February 2026

From inspiration to impact: design students from Regent’s University London explore open design for their dissertation projects

Design Article

Last year, we had the opportunity to speak at Regent’s UX Conference (Regent’s University London’s conference to showcase UX work by staff, students, and alumni), where we engaged with students to make them aware of open design and their ability to contribute design skills to open source projects. The talk sparked great discussion, and we ...

Lidia Luna Puerta
12 February 2026

When an upstream change broke smartcard FIPS authentication – and how we fixed it

Ubuntu Article

This is the story of how Canonical’s Support team provided bug-fix support: we tracked down an upstream change in OpenSC that inadvertently broke FIPS compatibility, coordinated with upstream developers across distributions, and delivered both a hotfix and a proper universal solution. ...