--- title: Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED] description: A buffer overflow in the virtual floppy disk controller of QEMU has been discovered. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process. This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s […] url: https://canonical.com/blog/ubuntu-security-update-on-venom-cve-2015-3456 --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Robbie](https://canonical.com/blog/author/robbie "More about Robbie") 13 May 2015 # Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED] --- Share the article A buffer overflow in the virtual floppy disk controller of QEMU has been [discovered](http://venom.crowdstrike.com/). An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process. This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an [AppArmor](https://wiki.ubuntu.com/AppArmor) profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment’s attack surface. A fix for this issue has been [committed](http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c) in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. To address the issue, ensure that [qemu-kvm 1.0+noroms-0ubuntu14.22](https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.22) (Ubuntu 12.04 LTS), [qemu 2.0.0+dfsg-2ubuntu1.11](https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.11) (Ubuntu 14.04 LTS), [qemu 2.1+dfsg-4ubuntu6.6](https://launchpad.net/ubuntu/+source/qemu/2.1+dfsg-4ubuntu6.6) (Ubuntu 14.10), [qemu 1:2.2+dfsg-5expubuntu9.1](https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.1) (Ubuntu 15.04) are installed. For reference, the [Ubuntu Security Notices website](http://www.ubuntu.com/usn/) is the best place to find information on security updates and the affected supported releases of Ubuntu.  Users can get notifications via email and RSS feeds from the USN site, as well as access the [Ubuntu CVE Tracker](http://people.canonical.com/~ubuntu-security/cve/). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. In submitting this form, I confirm that I have read and agree to [Canonical's Privacy Notice](https://canonical.com/legal/data-privacy/contact) and [Privacy Policy](https://canonical.com/legal/data-privacy). Sign up ## Share on --- ## Related posts [### AI infrastructure for telcos](https://canonical.com/blog/ai-infrastructure-for-telcos) Why moving from pilots to production changes the platform Artificial intelligence has moved beyond the demonstration phase. Telco operators are already exploring it for fault... [Benjamin Ryzman](https://canonical.com/blog/author/benjaminryzman) 2 October 2026 [### Canonical named a Challenger in the 2026 GartnerⓇ Magic Quadrant™ for Server Virtualization Platforms](https://canonical.com/blog/canonical-a-challenger-in-2026-gartner-magic-quadrant-for-server-virtualization-platforms) Canonical has been recognized as a Challenger in the 2026 GartnerⓇ Magic Quadrant™ for Server Virtualization Platforms. The inaugural edition of the report provides an... [Canonical](https://canonical.com/blog/author/canonical) 1 October 2026 [### Canonical announces the alpha release of Charmed OpenShell to help secure autonomous AI agent fleets](https://canonical.com/blog/charmed-openshell-alpha-release) To streamline enterprise deployment and lifecycle management, Canonical is announcing the alpha release of Charmed OpenShell. [Canonical](https://canonical.com/blog/author/canonical) 28 September 2026 [### Ubuntu coming soon to Snapdragon X2 Series platforms, unlocking more Linux PCs for the agentic world](https://canonical.com/blog/ubuntu-coming-soon-to-qualcomm-snapdragon-x2-series-platforms) Canonical and Qualcomm Technologies announce upcoming native Ubuntu support for Qualcomm’s flagship laptop silicon, delivering multi-day battery life, 80 TOPS NPU acceleration,... [Canonical](https://canonical.com/blog/author/canonical) 23 September 2026