--- title: Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED] description: A buffer overflow in the virtual floppy disk controller of QEMU has been discovered. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process. This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s […] url: https://canonical.com/blog/ubuntu-security-update-on-venom-cve-2015-3456?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Robbie](https://canonical.com/blog/author/robbie "More about Robbie") 13 May 2015 # Ubuntu Security Update on VENOM (CVE-2015-3456) [UPDATED] --- Share the article A buffer overflow in the virtual floppy disk controller of QEMU has been [discovered](http://venom.crowdstrike.com/). An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host’s QEMU process. This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack’s use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an [AppArmor](https://wiki.ubuntu.com/AppArmor) profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment’s attack surface. A fix for this issue has been [committed](http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c) in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. To address the issue, ensure that [qemu-kvm 1.0+noroms-0ubuntu14.22](https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.22) (Ubuntu 12.04 LTS), [qemu 2.0.0+dfsg-2ubuntu1.11](https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.11) (Ubuntu 14.04 LTS), [qemu 2.1+dfsg-4ubuntu6.6](https://launchpad.net/ubuntu/+source/qemu/2.1+dfsg-4ubuntu6.6) (Ubuntu 14.10), [qemu 1:2.2+dfsg-5expubuntu9.1](https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.1) (Ubuntu 15.04) are installed. For reference, the [Ubuntu Security Notices website](http://www.ubuntu.com/usn/) is the best place to find information on security updates and the affected supported releases of Ubuntu.  Users can get notifications via email and RSS feeds from the USN site, as well as access the [Ubuntu CVE Tracker](http://people.canonical.com/~ubuntu-security/cve/). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026 [### Advantech AOM-2721 is now Ubuntu Certified](https://canonical.com/blog/advantech-aom-2721-ubuntu-certified) Canonical announces that the Advantech AOM-2721 is officially joining the list of Ubuntu Certified Hardware. [Mikhail Khazov](https://canonical.com/blog/author/khazov-m) 13 August 2026 [### Canonical integrates NVIDIA Nemotron 3.5 Lightning with Ubuntu for always-on AI agents](https://canonical.com/blog/nvidia-nemotron-3-5-lightning) Canonical is pleased to announce that NVIDIA’s newly introduced NVIDIA Nemotron 3.5 Lightning, an open, customizable model built for always-on AI agents, is now available on... [Canonical](https://canonical.com/blog/author/canonical) 11 August 2026