Skip to main content
  1. Blog
  2. Article

Robbie
on 13 May 2015

Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED]

A buffer overflow in the virtual floppy disk controller of QEMU has been discovered. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process.

This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an AppArmor profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment’s attack surface.

A fix for this issue has been committed in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. To address the issue, ensure that qemu-kvm 1.0+noroms-0ubuntu14.22 (Ubuntu 12.04 LTS), qemu 2.0.0+dfsg-2ubuntu1.11 (Ubuntu 14.04 LTS), qemu 2.1+dfsg-4ubuntu6.6 (Ubuntu 14.10), qemu 1:2.2+dfsg-5expubuntu9.1 (Ubuntu 15.04) are installed.

For reference, the Ubuntu Security Notices website is the best place to find information on security updates and the affected supported releases of Ubuntu.  Users can get notifications via email and RSS feeds from the USN site, as well as access the Ubuntu CVE Tracker.

Related posts

Miguel Divo
13 February 2026

From inspiration to impact: design students from Regent’s University London explore open design for their dissertation projects

Design Article

Last year, we had the opportunity to speak at Regent’s UX Conference (Regent’s University London’s conference to showcase UX work by staff, students, and alumni), where we engaged with students to make them aware of open design and their ability to contribute design skills to open source projects. The talk sparked great discussion, and we ...

Lidia Luna Puerta
12 February 2026

When an upstream change broke smartcard FIPS authentication – and how we fixed it

Ubuntu Article

This is the story of how Canonical’s Support team provided bug-fix support: we tracked down an upstream change in OpenSC that inadvertently broke FIPS compatibility, coordinated with upstream developers across distributions, and delivered both a hotfix and a proper universal solution. ...

Benjamin Ryzman
12 February 2026

Open platforms, edge AI, and sovereign telco clouds: Ecrio & Canonical at MWC Barcelona

AI Article

Building telco clouds with open source At MWC Barcelona 2026, Canonical is demonstrating how telecommunications operators and enterprises can design and operate a cloud on their own terms: sovereign, cost-effective, and built on open platforms that span from core data centers to the intelligent edge. One of the demos is the result of Cano ...