{"id":"CVE-2015-3456","aliases":["BELL-CVE-2015-3456","DEBIAN-CVE-2015-3456","DLA-248-1","DLA-249-1","DLA-268-1","DSA-3259-1","DSA-3262-1","DSA-3274-1","EUVD-2015-3499","GHSA-f822-h734-j822","MGASA-2015-0220","MGASA-2015-0228","MGASA-2016-0098","RHSA-2015:0998","RHSA-2015:0999","RHSA-2015:1000","RHSA-2015:1001","RHSA-2015:1002","RHSA-2015:1003","RHSA-2015:1004","RHSA-2015:1011","RHSA-2015:1031","SUSE-SU-2015:0870-1","SUSE-SU-2015:0889-1","SUSE-SU-2015:0896-1","SUSE-SU-2015:0923-1","SUSE-SU-2015:0927-1","SUSE-SU-2015:0929-1","SUSE-SU-2015:0940-1","SUSE-SU-2015:0943-1","SUSE-SU-2015:0944-1","SUSE-SU-2015:1152-1","UBUNTU-CVE-2015-3456","USN-2608-1","openSUSE-SU-2024:10020-1","openSUSE-SU-2024:10196-1","openSUSE-SU-2024:10233-1"],"status":"published","title":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local...","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","severity":{"version":"2.0","score":7.7,"vector":"AV:A/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.15275,"percentile":0.96786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2012-08-31T14:36:20Z","modified":"2026-09-09T06:47:33Z","exploits":[{"source":"pocgithub","id":"vincentbernat/cve-2015-3456","title":"vincentbernat/cve-2015-3456","date":"2015-05-17","url":"https://github.com/vincentbernat/cve-2015-3456"},{"source":"exploitdb","id":"EDB-37053","title":"QEMU - Floppy Disk Controller (FDC) (PoC)","type":"dos","platform":"multiple","date":"2015-05-18","url":"https://www.exploit-db.com/exploits/37053"},{"source":"pocgithub","id":"orf53975/poisonfrog","title":"orf53975/poisonfrog","date":"2018-12-03","url":"https://github.com/orf53975/poisonfrog"}],"fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:2.3+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:2.3+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:2.3+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"qemu","fixed_in":["0.12.5+dfsg-3squeeze5"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"qemu-kvm","fixed_in":["0.12.5+dfsg-5+squeeze12"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"xen","fixed_in":["4.1.4-3+deb7u6"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"virtualbox","fixed_in":["4.1.18-dfsg-2+deb7u5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"virtualbox","fixed_in":["4.3.18-dfsg-3+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qemu","fixed_in":["1.6.2-1.10.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-vboxadditions","fixed_in":["4.3.28-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-virtualbox","fixed_in":["4.3.28-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"virtualbox","fixed_in":["4.3.28-1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-devel","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-devel","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-devel","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-devel","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-tools","fixed_in":["10:1.5.3-86.el7_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-devel-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-img-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-debuginfo","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-libs","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-debuginfo","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-devel","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-debuginfo","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-libs","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-debuginfo","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-devel","fixed_in":["0:3.0.3-146.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm-debug","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-debuginfo","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-qemu-img","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-tools","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm-debug","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-debuginfo","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-qemu-img","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-tools","fixed_in":["0:83-272.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-img-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:4::el6","package":"qemu-img-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev-debuginfo","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev-tools","fixed_in":["2:0.12.1.2-2.448.el6_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-devel-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"qemu-img-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-common-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev-debuginfo","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-devel-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"qemu-img-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-common-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev-debuginfo","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-tools-rhev","fixed_in":["10:2.1.2-23.el7_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","fixed_in":["0:6.6-20150512.0.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"rhev-hypervisor7","fixed_in":["0:7.1-20150512.1.el7ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-img","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-guest-agent","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-img","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm-debuginfo","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm-tools","fixed_in":["2:0.12.1.2-2.415.el6_5.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"virtualbox","fixed_in":["4.3.10-dfsg-1ubuntu5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.1-0ubuntu0.14.04.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5+dfsg-3squeeze5"}]}],"versions":["0.12.5+dfsg-3","0.12.5+dfsg-3squeeze1","0.12.5+dfsg-3squeeze2","0.12.5+dfsg-3squeeze3","0.12.5+dfsg-3squeeze4"]},{"source":"osv","ecosystem":"Debian:6.0","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5+dfsg-5+squeeze12"}]}],"versions":["0.12.5+dfsg-5","0.12.5+dfsg-5+squeeze1","0.12.5+dfsg-5+squeeze10","0.12.5+dfsg-5+squeeze11","0.12.5+dfsg-5+squeeze2","0.12.5+dfsg-5+squeeze3","0.12.5+dfsg-5+squeeze4","0.12.5+dfsg-5+squeeze4~bpo50+1","0.12.5+dfsg-5+squeeze5","0.12.5+dfsg-5+squeeze6","0.12.5+dfsg-5+squeeze7","0.12.5+dfsg-5+squeeze8","0.12.5+dfsg-5+squeeze9"]},{"source":"osv","ecosystem":"Debian:6.0","package":"virtualbox-ose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-dfsg-1+squeeze4"}]}],"versions":["3.2.10-dfsg-1","3.2.10-dfsg-1+squeeze1","3.2.10-dfsg-1+squeeze2","3.2.10-dfsg-1+squeeze3"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12~bpo70+1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3+deb7u6"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1","4.1.4-3+deb7u2","4.1.4-3+deb7u3","4.1.4-3+deb7u4","4.1.4-3+deb7u5"]},{"source":"osv","ecosystem":"Debian:7","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-dfsg-2+deb7u5"}]}],"versions":["4.1.18-dfsg-2+deb7u1","4.1.18-dfsg-2+deb7u2","4.1.18-dfsg-2+deb7u3","4.1.18-dfsg-2+deb7u3~bpo60+1","4.1.18-dfsg-2+deb7u4","4.1.18-dfsg-2+deb7u4~bpo60+1"]},{"source":"osv","ecosystem":"Debian:8","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.18-dfsg-3+deb8u2"}]}],"versions":["1.4.0svn4130-dfsg-1","4.0.10-dfsg-1","4.0.10-dfsg-1~bpo60+1","4.0.10-dfsg-1~bpo60+2","4.0.8-dfsg-1","4.0.8-dfsg-2","4.0.8-dfsg-2~bpo60+1","4.1.0-dfsg-1","4.1.0-dfsg-2","4.1.10-dfsg-1","4.1.12-dfsg-1","4.1.12-dfsg-2","4.1.14-dfsg-1","4.1.14-dfsg-2","4.1.16-dfsg-1","4.1.16-dfsg-2","4.1.18-dfsg-1","4.1.18-dfsg-1.1","4.1.18-dfsg-2","4.1.18-dfsg-2.1","4.1.2-dfsg-1","4.1.4-dfsg-1","4.1.6-dfsg-1","4.1.6-dfsg-2","4.1.8-dfsg-1","4.1.8-dfsg-2","4.2.10-dfsg-1","4.2.10-dfsg-1~bpo70+1","4.2.16-dfsg-1","4.2.16-dfsg-1~bpo70+1","4.2.16-dfsg-2","4.2.16-dfsg-3","4.2.16-dfsg-3~bpo70+1","4.3.10-dfsg-1","4.3.10-dfsg-1~bpo70+1","4.3.12-dfsg-1","4.3.12-dfsg-1~bpo70+1","4.3.14-dfsg-1","4.3.14-dfsg-1~bpo70+1","4.3.18-dfsg-1","4.3.18-dfsg-2","4.3.18-dfsg-2~bpo70+1","4.3.18-dfsg-3","4.3.18-dfsg-3+deb8u1","4.3.2-dfsg-1","4.3.6-dfsg-1","4.3.6-dfsg-2","4.3.6-dfsg-2~bpo70+1"]},{"source":"osv","ecosystem":"Mageia:4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.10.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-1.5.mga5"}]}],"bundled":45},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcacard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:1.5.3-86.el7_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"qemu-kvm-rhev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xen-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xen-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-146.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kmod-kvm-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::client","package":"kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kmod-kvm-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_virtualization:5::server","package":"kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:83-272.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"qemu-kvm-rhev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"qemu-kvm-rhev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.448.el6_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-devel-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"libcacard-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-img-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-common-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-rhev-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"qemu-kvm-tools-rhev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10:2.1.2-23.el7_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6-20150512.0.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"rhev-hypervisor7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1-20150512.1.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.12.1.2-2.415.el6_5.15"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_04-18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_04-18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_04-18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2_04-18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.11"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-dfsg-1ubuntu5"}]}],"versions":["4.2.16-dfsg-3","4.2.16-dfsg-3ubuntu1","4.3.2-dfsg-1","4.3.2-dfsg-1ubuntu1","4.3.2-dfsg-1ubuntu2","4.3.6-dfsg-1","4.3.6-dfsg-2","4.3.10-dfsg-1","4.3.10-dfsg-1ubuntu1","4.3.10-dfsg-1ubuntu2","4.3.10-dfsg-1ubuntu3","4.3.10-dfsg-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-0ubuntu0.14.04.6"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.11"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.10-2.5"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0_12-1.3"}]}],"bundled":124},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-1.5"}]}],"bundled":53}],"products":[{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_virtualization"},{"vendor":"redhat","product":"openstack"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://www.exploit-db.com/exploits/37053/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032306","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://kb.juniper.net/JSA10783","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3259","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0999.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10118","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1001.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=143229451215900\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://support.citrix.com/article/CTX201078","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://xenbits.xen.org/xsa/advisory-133.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","article","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1003.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032917","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=143387998230996\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0998.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bto.bluecoat.com/security-advisory/sa95","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1004.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://venom.crowdstrike.com/","tags":["x_refsource_MISC","x_transferred","web","article","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1011.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://support.lenovo.com/us/en/product_security/venom","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201604-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1002.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2608-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10693","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032311","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3262","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201602-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/74640","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3274","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://access.redhat.com/articles/1444903","tags":["x_refsource_CONFIRM","x_transferred","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1000.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3456","tags":["advisory"]},{"url":"http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c"},{"url":"https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten"},{"url":"https://www.exploit-db.com/exploits/37053"},{"url":"http://venom.crowdstrike.com"},{"url":"https://github.com/advisories/GHSA-f822-h734-j822"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-3456","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3456","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0220.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15929","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2015-0999.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0228.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15935","tags":["report"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0098.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16956","tags":["report"]},{"url":"http://xenbits.xen.org/xsa/advisory-117.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-118.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-119.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-120.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-121.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-122.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-123.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-124.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-125.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-126.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-127.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-128.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-129.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-130.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-131.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-132.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-134.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-135.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-136.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-137.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-138.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-139.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-140.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-141.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-142.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-145.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-146.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-147.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-148.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-149.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-150.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-151.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-152.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-153.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-154.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-155.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-156.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-158.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-159.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-162.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-163.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-164.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-165.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-166.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-167.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-168.html","tags":["advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-170.html","tags":["advisory"]},{"url":"http://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-451.html","tags":["web"]},{"url":"http://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-452.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0998","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218611","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0998.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3456","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0999","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0999.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1000","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1000.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1001","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1001.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1002","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1002.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1003","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1003.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1004","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1004.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1011","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1011.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1031","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1031.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150870-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/812836","tags":["report"]},{"url":"https://bugzilla.suse.com/812983","tags":["report"]},{"url":"https://bugzilla.suse.com/817593","tags":["report"]},{"url":"https://bugzilla.suse.com/821819","tags":["report"]},{"url":"https://bugzilla.suse.com/824340","tags":["report"]},{"url":"https://bugzilla.suse.com/829800","tags":["report"]},{"url":"https://bugzilla.suse.com/841080","tags":["report"]},{"url":"https://bugzilla.suse.com/842006","tags":["report"]},{"url":"https://bugzilla.suse.com/842088","tags":["report"]},{"url":"https://bugzilla.suse.com/858858","tags":["report"]},{"url":"https://bugzilla.suse.com/864391","tags":["report"]},{"url":"https://bugzilla.suse.com/864649","tags":["report"]},{"url":"https://bugzilla.suse.com/864650","tags":["report"]},{"url":"https://bugzilla.suse.com/864653","tags":["report"]},{"url":"https://bugzilla.suse.com/864655","tags":["report"]},{"url":"https://bugzilla.suse.com/864665","tags":["report"]},{"url":"https://bugzilla.suse.com/864671","tags":["report"]},{"url":"https://bugzilla.suse.com/864673","tags":["report"]},{"url":"https://bugzilla.suse.com/864678","tags":["report"]},{"url":"https://bugzilla.suse.com/864682","tags":["report"]},{"url":"https://bugzilla.suse.com/864769","tags":["report"]},{"url":"https://bugzilla.suse.com/864796","tags":["report"]},{"url":"https://bugzilla.suse.com/864801","tags":["report"]},{"url":"https://bugzilla.suse.com/864802","tags":["report"]},{"url":"https://bugzilla.suse.com/864804","tags":["report"]},{"url":"https://bugzilla.suse.com/864805","tags":["report"]},{"url":"https://bugzilla.suse.com/864811","tags":["report"]},{"url":"https://bugzilla.suse.com/864812","tags":["report"]},{"url":"https://bugzilla.suse.com/864814","tags":["report"]},{"url":"https://bugzilla.suse.com/870439","tags":["report"]},{"url":"https://bugzilla.suse.com/873235","tags":["report"]},{"url":"https://bugzilla.suse.com/874749","tags":["report"]},{"url":"https://bugzilla.suse.com/874788","tags":["report"]},{"url":"https://bugzilla.suse.com/876842","tags":["report"]},{"url":"https://bugzilla.suse.com/877642","tags":["report"]},{"url":"https://bugzilla.suse.com/877645","tags":["report"]},{"url":"https://bugzilla.suse.com/878541","tags":["report"]},{"url":"https://bugzilla.suse.com/886535","tags":["report"]},{"url":"https://bugzilla.suse.com/920571","tags":["report"]},{"url":"https://bugzilla.suse.com/924018","tags":["report"]},{"url":"https://bugzilla.suse.com/929339","tags":["report"]},{"url":"https://bugzilla.suse.com/932267","tags":["report"]},{"url":"https://bugzilla.suse.com/932770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150889-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150896-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/886378","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150923-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/922705","tags":["report"]},{"url":"https://bugzilla.suse.com/922709","tags":["report"]},{"url":"https://bugzilla.suse.com/927967","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3340","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150927-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/910441","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/598271","tags":["report"]},{"url":"https://bugzilla.suse.com/598298","tags":["report"]},{"url":"https://bugzilla.suse.com/599095","tags":["report"]},{"url":"https://bugzilla.suse.com/603161","tags":["report"]},{"url":"https://bugzilla.suse.com/603179","tags":["report"]},{"url":"https://bugzilla.suse.com/610682","tags":["report"]},{"url":"https://bugzilla.suse.com/619991","tags":["report"]},{"url":"https://bugzilla.suse.com/621793","tags":["report"]},{"url":"https://bugzilla.suse.com/626654","tags":["report"]},{"url":"https://bugzilla.suse.com/637297","tags":["report"]},{"url":"https://bugzilla.suse.com/689895","tags":["report"]},{"url":"https://bugzilla.suse.com/690781","tags":["report"]},{"url":"https://bugzilla.suse.com/695510","tags":["report"]},{"url":"https://bugzilla.suse.com/695766","tags":["report"]},{"url":"https://bugzilla.suse.com/698237","tags":["report"]},{"url":"https://bugzilla.suse.com/701161","tags":["report"]},{"url":"https://bugzilla.suse.com/702823","tags":["report"]},{"url":"https://bugzilla.suse.com/704933","tags":["report"]},{"url":"https://bugzilla.suse.com/705095","tags":["report"]},{"url":"https://bugzilla.suse.com/705304","tags":["report"]},{"url":"https://bugzilla.suse.com/740165","tags":["report"]},{"url":"https://bugzilla.suse.com/764526","tags":["report"]},{"url":"https://bugzilla.suse.com/777084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150940-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/777628","tags":["report"]},{"url":"https://bugzilla.suse.com/789944","tags":["report"]},{"url":"https://bugzilla.suse.com/789945","tags":["report"]},{"url":"https://bugzilla.suse.com/789948","tags":["report"]},{"url":"https://bugzilla.suse.com/789950","tags":["report"]},{"url":"https://bugzilla.suse.com/789951","tags":["report"]},{"url":"https://bugzilla.suse.com/826717","tags":["report"]},{"url":"https://bugzilla.suse.com/880751","tags":["report"]},{"url":"https://bugzilla.suse.com/895798","tags":["report"]},{"url":"https://bugzilla.suse.com/895799","tags":["report"]},{"url":"https://bugzilla.suse.com/895802","tags":["report"]},{"url":"https://bugzilla.suse.com/903850","tags":["report"]},{"url":"https://bugzilla.suse.com/903967","tags":["report"]},{"url":"https://bugzilla.suse.com/903970","tags":["report"]},{"url":"https://bugzilla.suse.com/905465","tags":["report"]},{"url":"https://bugzilla.suse.com/905467","tags":["report"]},{"url":"https://bugzilla.suse.com/906439","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9030","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150943-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/709405","tags":["report"]},{"url":"https://bugzilla.suse.com/712137","tags":["report"]},{"url":"https://bugzilla.suse.com/722643","tags":["report"]},{"url":"https://bugzilla.suse.com/722958","tags":["report"]},{"url":"https://bugzilla.suse.com/724813","tags":["report"]},{"url":"https://bugzilla.suse.com/725008","tags":["report"]},{"url":"https://bugzilla.suse.com/747339","tags":["report"]},{"url":"https://bugzilla.suse.com/753313","tags":["report"]},{"url":"https://bugzilla.suse.com/757031","tags":["report"]},{"url":"https://bugzilla.suse.com/770153","tags":["report"]},{"url":"https://bugzilla.suse.com/772586","tags":["report"]},{"url":"https://bugzilla.suse.com/786813","tags":["report"]},{"url":"https://bugzilla.suse.com/818182","tags":["report"]},{"url":"https://bugzilla.suse.com/834196","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2007","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/789940","tags":["report"]},{"url":"https://bugzilla.suse.com/789988","tags":["report"]},{"url":"https://bugzilla.suse.com/792476","tags":["report"]},{"url":"https://bugzilla.suse.com/793927","tags":["report"]},{"url":"https://bugzilla.suse.com/794316","tags":["report"]},{"url":"https://bugzilla.suse.com/797014","tags":["report"]},{"url":"https://bugzilla.suse.com/797031","tags":["report"]},{"url":"https://bugzilla.suse.com/797523","tags":["report"]},{"url":"https://bugzilla.suse.com/798188","tags":["report"]},{"url":"https://bugzilla.suse.com/799694","tags":["report"]},{"url":"https://bugzilla.suse.com/800156","tags":["report"]},{"url":"https://bugzilla.suse.com/800275","tags":["report"]},{"url":"https://bugzilla.suse.com/802690","tags":["report"]},{"url":"https://bugzilla.suse.com/805094","tags":["report"]},{"url":"https://bugzilla.suse.com/806736","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0153","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151152-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3456","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2608-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2756","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-561313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3456","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T18:00:00Z","modified":"2024-08-06T05:47:57.892Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3499","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T18:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:07.516949Z"}],"ghsa":[{"id":"GHSA-f822-h734-j822","title":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local...","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2022-05-13T01:05:10Z","modified":"2025-04-12T12:48:58Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:21.867045Z"}],"nvd":[{"id":"CVE-2015-3456","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T18:59:00.157Z","modified":"2026-06-17T00:25:57.477Z","cvss":[{"version":"2.0","score":7.7,"vector":"AV:A/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"BELL-CVE-2015-3456","title":"CVE-2015-3456 does not affect BellSoft software","status":"withdrawn","published":"2015-05-13T18:59:00Z","modified":"2026-01-28T07:20:45.842093Z","cvss":[{"version":"2.0","score":7.7,"vector":"AV:A/AC:L/Au:S/C:C/I:C/A:C","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-3456","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T18:59:00Z","modified":"2026-04-16T06:20:15.147834307Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3456","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T18:59:00.157Z","modified":"2026-09-09T06:47:33.140970029Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-248-1","title":"qemu - security update","status":"published","published":"2015-06-19T00:00:00Z","modified":"2026-03-09T01:19:21.657666Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-249-1","title":"qemu-kvm - security update","status":"published","published":"2015-06-19T00:00:00Z","modified":"2026-03-09T01:20:54.419631Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-268-1","title":"virtualbox-ose - security update","status":"published","published":"2015-07-05T00:00:00Z","modified":"2026-03-09T01:21:18.462506Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3259-1","title":"qemu - security update","status":"published","published":"2015-05-13T00:00:00Z","modified":"2026-03-09T01:20:06.122655Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3262-1","title":"xen - security update","status":"published","published":"2015-05-18T00:00:00Z","modified":"2026-03-09T01:19:39.079974Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3274-1","title":"virtualbox - security update","status":"published","published":"2015-05-28T00:00:00Z","modified":"2026-03-09T01:22:08.375992Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0220","title":"Updated qemu packages fix CVE-2015-3456","description":"Updated qemu packages fix security vulnerability:\n\nAn out-of-bounds memory access flaw was found in the way QEMU's virtual\nFloppy Disk Controller (FDC) handled FIFO buffer access while processing\ncertain FDC commands. A privileged guest user could use this flaw to crash\nthe guest or, potentially, execute arbitrary code on the host with the\nprivileges of the host's QEMU process corresponding to the guest\n(CVE-2015-3456).\n","status":"published","published":"2015-05-13T15:54:07Z","modified":"2026-04-16T06:23:58.843599419Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2015-0228","title":"Updated virtualbox packages fix security vulnerabilities","description":"Updated virtualbox packages fixes security vulnerability\n\nThis update provides the 4.3.28 maintenance release fixing the\nfollowing security issue:\n\nThe Floppy Disk Controller (FDC) in QEMU, XEN, KVM and virtualbox allows\nlocal guest users to cause a denial of service (out-of-bounds write and\nguest crash) or possibly execute arbitrary code via the FD_CMD_READ_ID,\nFD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands,\naka VENOM (CVE-2015-3456).\n\nFor other fixes in the maintenance release, read the referenced changelog.\n","status":"published","published":"2015-05-15T18:23:49Z","modified":"2026-04-16T06:26:20.793660627Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0098","title":"Updated xen packages fix security vulnerabilities","description":"This xen update is based on upstream 4.5.2 maintenance release, and fixes the\nfollowing security issues:\n\nThe vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running\non ARM hardware with general interrupt controller (GIC) version 2, allows\nlocal guest users to cause a denial of service (host crash) by writing an\ninvalid value to the GICD.SGIR register (CVE-2015-0268).\n\nThe ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local\nguests to cause a denial of service by causing a large number messages to\nbe logged (CVE-2015-1563).\n\nThe emulation routines for unspecified X86 devices in Xen 3.2.x through\n4.5.x does not properly initialize data, which allow local HVM guest users\nto obtain sensitive information via vectors involving an unsupported access\nsize (CVE-2015-2044).\n\nThe HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not\nproperly initialize data structures, which allows local guest users to\nobtain sensitive information via unspecified vectors (CVE-2015-2045).\n\nXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly\nrestrict access to PCI command registers, which might allow local guest\nusers to cause a denial of service (non-maskable interrupt and host crash)\nby disabling the (1) memory or (2) I/O decoding for a PCI Express device\nand then accessing the device, which triggers an Unsupported Request (UR)\nresponse (CVE-2015-2150).\n\nThe x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment\noverrides for instructions with register operands, which allows local guest\nusers to obtain sensitive information, cause a denial of service (memory\ncorruption), or possibly execute arbitrary code via unspecified vectors\n(CVE-2015-2151).\n\nXen 4.5.x and earlier enables certain default backends when emulating a VGA\ndevice for an x86 HVM guest qemu even when the configuration disables them,\nwhich allows local guest users to obtain access to the VGA console by (1)\nsetting the DISPLAY environment variable, when compiled with SDL support,\nor connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not\ncompiled with SDL support (CVE-2015-2152).\n\nXen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows\nremote domains with partial management control to cause a denial of service\n(host lock) via unspecified domctl operations (CVE-2015-2751). \n\nThe XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when\nusing a PCI passthrough device, is not preemptable, which allows local x86\nHVM domain users to cause a denial of service (host CPU consumption) via\na crafted request to the device model (qemu-dm) (CVE-2015-2752).\n\nQEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access\nto PCI command registers, which might allow local HVM guest users to cause\na denial of service (non-maskable interrupt and host crash) by disabling\nthe (1) memory or (2) I/O decoding for a PCI Express device and then\naccessing the device, which triggers an Unsupported Request (UR) response\n(CVE-2015-2756).\n\nHeap-based buffer overflow in the PCNET controller in QEMU allows remote\nattackers to execute arbitrary code by sending a packet with\nTXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS\nset (CVE-2015-3209).\n\nStack-based buffer overflow in the xl command line utility in Xen 4.1.x\nthrough 4.5.x allows local guest administrators to gain privileges via a\nlong configuration argument (CVE-2015-3259).\n\nXen 4.2.x through 4.5.x does not initialize certain fields, which allows\ncertain remote service domains to obtain sensitive information from memory\nvia a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request\n(CVE-2015-3340).\n\nThe Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier\nand KVM, allows local guest users to cause a denial of service (out-of-bounds\nwrite and guest crash) or possibly execute arbitrary code via the (1)\nFD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified\ncommands, aka VENOM (CVE-2015-3456).\n\nXen 3.3.x through 4.5.x does not properly restrict write access to the host\nMSI message data field, which allows local x86 HVM guest administrators\ncause a denial of service (host interrupt handling confusion) via vectors\nrelated to qemu and accessing spanning multiple fields (CVE-2015-4103).\n\nXen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask\nbits, which allows local x86 HVM guest users to cause a denial of service\n(unexpected interrupt and host crash) via unspecified vectors \n(CVE-2015-4104).\n\nXen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error\nmessages, which allows local x86 HVM guests to cause a denial of service\n(host disk consumption) via certain invalid operations (CVE-2015-4105).\n\nQEMU does not properly restrict write access to the PCI config space for\ncertain PCI pass-through devices, which mighy allow local x86 HVM guests\nto gain privileges, cause a denial of service (host crash), obtain\nsensitive information, or possibly have other unspecified impact via\nunknown vectors (CVE-2015-4106).\n\nGNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant\ntable operation version, which allows local guest domains to cause a\ndenial of service (NULL pointer dereference) via a hypercall without a\nGNTTABOP_setup_table or GNTTABOP_set_version (CVE-2015-4163).\n\nThe compat_iret function in Xen 3.1 through 4.5 iterates the wrong way\nthrough a loop, which allows local 32-bit PV guest administrators to cause\na denial of service (large loop and system hang) via a hypercall_iret call\nwith EFLAGS.VM set (CVE-2015-4164).\n\nHeap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen\n4.5.x and earlier, when the container has a CDROM drive enabled, allows\nlocal guest users to execute arbitrary code on the host via unspecified\nATAPI commands (CVE-2015-5154).\n\nThe C+ mode offload emulation in the RTL8139 network card device model in\nQEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read\nprocess heap memory via unspecified vectors (CVE-2015-5165).\n\nUse-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not\ncompletely unplug emulated block devices, which allows local HVM guest\nusers to gain privileges by unplugging a block device twice (CVE-2015-5166).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"alignment\ncheck\" (#AC) exceptions. This causes the microcode to enter an infinite loop\nwhere the core never receives another interrupt. The host kernel panics due\nto this effect (CVE-2015-5307).\n\nThe xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x,\n4.4.x, and earlier does not limit the number of printk console messages\nwhen reporting a failure to retrieve a reference on a foreign page, which\nallows remote domains to cause a denial of service by leveraging\npermissions to map the memory of a foreign guest (CVE-2015-6654).\n\nlibxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag\non disks when using the qemu-xen device model, which allows local guest\nusers to write to a read-only disk image (CVE-2015-7311).\n\nA heap-based buffer overflow flaw was discovered in the way QEMU's AMD\nPC-Net II Ethernet Controller emulation received certain packets in\nloopback mode. A privileged user (with the CAP_SYS_RAWIO capability)\ninside a guest could use this flaw to crash the host QEMU process\n(resulting in denial of service) or, potentially, execute arbitrary\ncode with privileges of the host QEMU process (CVE-2015-7504).\n\nMulticall support for arm in xen 4.4.x and later was not correctly set\nup with correct functionality and therefore exposed to guests a code path\nwhich crashes the host. Any guest can issue a preemptable hypercall via the\nmulticall interface to exploit this vulnerability (CVE-2015-7812).\n\nXen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console\nmessages when reporting unimplemented hypercalls, which allows local guests\nto cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op\nhypercalls, which are not properly handled in the do_physdev_op function\nin arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not\nproperly handled in the do_hvm_op function in arch/arm/hvm.c (CVE-2015-7813).\n\nRace condition in the relinquish_memory function in arch/arm/domain.c in\nXen 4.6.x and earlier allows local domains with partial management control\nto cause a denial of service (host crash) via vectors involving the\ndestruction of a domain and using XENMEM_decrease_reservation to reduce\nthe memory of the domain (CVE-2015-7814).\n\nThe mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does\nnot properly validate level 2 page table entries, which allows local PV\nguest administrators to gain privileges via a crafted superpage mapping\n(CVE-2015-7835).\n\nMultiple memory leaks in Xen 4.0 through 4.6.x allow local guest\nadministrators or domains with certain permission to cause a denial of\nservice (memory consumption) via a large number of \"teardowns\" of domains\nwith the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus\nhypercall or the xenoprofile state vcpu pointer array allocated using the\n(2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall\n(CVE-2015-7969).\n\nThe p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x,\n3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest\nadministrators to cause a denial of service (CPU consumption and possibly\nreboot) via crafted memory contents that triggers a \"time-consuming linear\nscan,\" related to Populate-on-Demand (CVE-2015-7970).\n\nXen 3.2.x through 4.6.x does not limit the number of printk console messages\nwhen logging certain pmu and profiling hypercalls, which allows local guests\nto cause a denial of service via a sequence of crafted (1) \nHYPERCALL_xenoprof_op hypercalls, which are not properly handled in the \ndo_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op\nhypercalls, which are not properly handled in the do_xenpmu_op function in\narch/x86/cpu/vpmu.c (CVE-2015-7971).\n\nThe (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) \nlibxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through\n4.6.x do not properly calculate the balloon size when using the\npopulate-on-demand (PoD) system, which allows local HVM guest users to\ncause a denial of service (guest crash) via unspecified vectors related\nto \"heavy memory pressure.\" (CVE-2015-7972)\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"debug check\"\n(#DB) exceptions. This causes the microcode to enter an infinite loop where\nthe core never receives another interrupt. The host kernel panics due to\nthis effect (CVE-2015-8104).\n\nXen 4.6.x and earlier does not properly enforce limits on page order inputs\nfor the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap,\n(3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations,\nwhich allows ARM guest OS administrators to cause a denial of service (CPU\nconsumption, guest reboot, or watchdog timeout and host reboot) and possibly\nhave unspecified other impact via unknown vectors (CVE-2015-8338).\n\nThe memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x\ndoes not properly hand back pages to a domain, which might allow guest OS\nadministrators to cause a denial of service (host crash) via unspecified\nvectors related to domain teardown (CVE-2015-8339).\n\nThe memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x\ndoes not properly release locks, which might allow guest OS administrators\nto cause a denial of service (deadlock or host crash) via unspecified\nvectors, related to XENMEM_exchange error handling (CVE-2015-8340).\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in the\nparavirtualized guest could exploit this flaw to cause a denial of service\n(crash the host) or potentially execute arbitrary code on the host\n(CVE-2015-8550).\n\nInformation leak in legacy x86 FPU/XMM initialization (CVE-2015-8555).\n\nThe PV superpage functionality lacks certain validity checks on data\nbeing passed to the hypervisor by guests.  This is the case for the\npage identifier (MFN) passed to MMUEXT_MARK_SUPER and\nMMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as\nwell as for various forms of page table updates. Use of the feature,\nwhich is disabled by default, may have unknown effects, ranging from\ninformation leaks through Denial of Service to privilege escalation.\n(CVE-2016-1570)\n\nWhile INVLPG does not cause a General Protection Fault when used on a\nnon-canonical address, INVVPID in its \"individual address\" variant,\nwhich is used to back the intercepted INVLPG in certain cases, fails in\nsuch cases. Failure of INVVPID results in a hypervisor bug check.\nA malicious guest can crash the host, leading to a Denial of Service.\n(CVE-2016-1571)\n\nXen 4.6.x and earlier allows local guest administrators to cause a denial\nof service (host reboot) via vectors related to multiple mappings of MMIO\npages with different cachability settings (CVE-2016-2270).\n\nVMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows\nlocal HVM guest users to cause a denial of service (guest crash) via\nvectors related to a non-canonical RIP (CVE-2016-2271).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-03-07T11:20:30Z","modified":"2026-04-16T06:26:13.002854919Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10020-1","title":"python-virtualbox-5.1.10-2.5 on GA media","description":"These are all security issues fixed in the python-virtualbox-5.1.10-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:12:58.917626Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10196-1","title":"xen-4.7.0_12-1.3 on GA media","description":"These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:39.408456Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10233-1","title":"qemu-2.6.1-1.5 on GA media","description":"These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:08.968833Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:0998","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-13T10:36:07Z","modified":"2026-06-29T10:09:04Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:0999","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-13T10:36:23Z","modified":"2026-06-29T10:09:05Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1000","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-13T10:36:12Z","modified":"2026-06-29T10:09:05Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1001","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-13T10:36:32Z","modified":"2026-06-29T10:09:06Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1002","title":"Red Hat Security Advisory: xen security update","status":"published","published":"2024-09-13T10:36:29Z","modified":"2026-06-29T10:09:06Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1003","title":"Red Hat Security Advisory: kvm security update","status":"published","published":"2024-09-13T10:36:23Z","modified":"2026-06-29T10:09:07Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1004","title":"Red Hat Security Advisory: qemu-kvm-rhev security update","status":"published","published":"2024-09-13T10:36:17Z","modified":"2026-06-29T10:09:07Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1011","title":"Red Hat Security Advisory: rhev-hypervisor security update","status":"published","published":"2024-09-13T10:36:38Z","modified":"2026-06-29T10:09:10Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:1031","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-13T10:36:48Z","modified":"2026-06-29T10:09:13Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0870-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T02:40:36.136649Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0889-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T02:14:59.402186Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0896-1","title":"Security update for qemu","description":"\nqemu / kvm was updated to fix a security issue and some bugs.\n\nSecurity issue fixed:\n\n* CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used\n  to denial of service attacks or potential code execution against the host.\n\n* CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder.\n\n\nBugs fixed:\n- qemu truncates vhd images in virt-rescue (bsc#886378)\n\n- Update kvm-supported.txt with the current rbd support status.\n\n- enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349)","status":"published","published":"2015-05-12T21:54:11Z","modified":"2026-02-04T02:15:46.373383Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0923-1","title":"Security update for xen","description":"\nXEN was updated to fix two security issues and bugs.\n\nSecurity issues fixed:\n* CVE-2015-3340: Xen did not initialize certain fields, which allowed\n  certain remote service domains to obtain sensitive information from\n  memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist\n  request.\n\n* CVE-2015-2751: Xen, when using toolstack disaggregation, allowed remote\n  domains with partial management control to cause a denial of service\n  (host lock) via unspecified domctl operations.\n\n* CVE-2015-2752: The XEN_DOMCTL_memory_mapping hypercall in Xen, when\n  using a PCI passthrough device, was not preemptable, which allowed local\n  x86 HVM domain users to cause a denial of service (host CPU consumption)\n  via a crafted request to the device model (qemu-dm).\n\n* CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used\n  to denial of service attacks or potential code execution against the host.\n\nBugs fixed:\n- xentop: Fix memory leak on read failure \n","status":"published","published":"2015-05-12T21:54:24Z","modified":"2026-02-04T03:13:13.274354Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0927-1","title":"Security update for Xen","description":"\nXen was updated to fix two security issues and a bug:\n\n    * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which\n      could be used to carry out denial of service attacks or potential\n      code execution against the host. This vulnerability is also known as\n      VENOM.\n    * CVE-2015-3340: Xen did not initialize certain fields, which allowed\n      certain remote service domains to obtain sensitive information from\n      memory via a (1) XEN_DOMCTL_gettscinfo or (2)\n      XEN_SYSCTL_getdomaininfolist request.\n    * An exception in setCPUAffinity when restoring guests. (bsc#910441)\n\nSecurity Issues:\n\n    * CVE-2015-3456\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456\u003e\n    * CVE-2015-3340\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340\u003e\n\n","status":"published","published":"2015-05-13T08:31:50Z","modified":"2026-02-04T04:01:10.84942Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0929-1","title":"Security update for kvm","description":"\nThe kvm qemu vt100 emulation was affected by a problem where specific vt100 \nsequences could have been used by guest users to affect the host. \n(CVE-2012-3515 aka XSA-17).\n\nAlso a temp file race was fixed. (CVE-2012-2652)\n\nSecurity Issue reference:\n\n    * CVE-2012-3515\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515\u003e\n    * CVE-2012-2652\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652\u003e\n\n","status":"published","published":"2012-08-31T14:36:20Z","modified":"2026-02-04T03:38:26.839919Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0940-1","title":"Security update for Xen","description":"\nThis update fixes the following security issues in Xen:\n\n    * CVE-2012-5510: Grant table version switch list corruption\n      vulnerability (XSA-26)\n    * CVE-2012-5511: Several HVM operations do not validate the range of\n      their inputs (XSA-27)\n    * CVE-2012-5513: XENMEM_exchange may overwrite hypervisor memory\n      (XSA-29)\n    * CVE-2012-5514: Missing unlock in\n      guest_physmap_mark_populate_on_demand() (XSA-30)\n    * CVE-2012-5515: Several memory hypercall operations allow invalid\n      extent order values (XSA-31)\n\nAlso the following fix has been applied:\n\n    * bnc#777628 - guest 'disappears' after live migration\n      Updated block-dmmd script\n\nSecurity Issues references:\n\n    * CVE-2012-5513\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5513\u003e\n    * CVE-2012-5514\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5514\u003e\n    * CVE-2012-5511\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5511\u003e\n    * CVE-2012-5510\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5510\u003e\n    * CVE-2012-5515\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5515\u003e\n\n","status":"published","published":"2012-11-22T17:59:15Z","modified":"2026-02-04T02:24:40.497699Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0943-1","title":"Security update for KVM","description":"\nThis update fixes a file permission issue with qga (the QEMU Guest Agent) \nfrom the qemu/kvm package and includes several bug-fixes.\n\n(bnc#818182) (CVE-2013-2007) (bnc#786813) (bnc#725008) (bnc#712137) \n(bnc#824340)\n\nSecurity Issues:\n\n    * CVE-2013-2007\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007\u003e\n\n","status":"published","published":"2013-06-24T20:56:39Z","modified":"2026-02-04T03:18:53.801838Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0944-1","title":"Security update for Xen","description":"\nXEN has been updated to fix various bugs and security issues:\n\n    * \n\n      CVE-2013-0153: (XSA 36) To avoid an erratum in early hardware, the\n      Xen AMD IOMMU code by default choose to use a single interrupt\n      remapping table for the whole system. This sharing implied that any\n      guest with a passed through PCI device that is bus mastering capable\n      can inject interrupts into other guests, including domain 0. This has\n      been disabled for AMD chipsets not capable of it.\n\n    * \n\n      CVE-2012-6075: qemu: The e1000 had overflows under some conditions,\n      potentially corrupting memory.\n\n    * \n\n      CVE-2013-0154: (XSA 37) Hypervisor crash due to incorrect ASSERT\n      (debug build only)\n\n    * \n\n      CVE-2012-5634: (XSA-33) A VT-d interrupt remapping source validation\n      flaw was fixed.\n\nAlso the following bugs have been fixed:\n\n    * bnc#805094 - xen hot plug attach/detach fails\n    * bnc#802690 - domain locking can prevent a live migration from\n      completing\n    * bnc#797014 - no way to control live migrations\n          o fix logic error in stdiostream_progress\n          o restore logging in xc_save\n          o add options to control migration tunables\n    * bnc#806736: enabling xentrace crashes hypervisor\n    * Upstream patches from Jan 26287-sched-credit-pick-idle.patch\n      26501-VMX-simplify-CR0-update.patch\n      26502-VMX-disable-SMEP-when-not-paging.patch\n      26516-ACPI-parse-table-retval.patch (Replaces\n      CVE-2013-0153-xsa36.patch) 26517-AMD-IOMMU-clear-irtes.patch\n      (Replaces CVE-2013-0153-xsa36.patch)\n      26518-AMD-IOMMU-disable-if-SATA-combined-mode.patch (Replaces\n      CVE-2013-0153-xsa36.patch)\n      26519-AMD-IOMMU-perdev-intremap-default.patch (Replaces\n      CVE-2013-0153-xsa36.patch) 26526-pvdrv-no-devinit.patch\n      26531-AMD-IOMMU-IVHD-special-missing.patch (Replaces\n      CVE-2013-0153-xsa36.patch)\n    * bnc#798188 - Add $network to xend initscript dependencies\n    * bnc#799694 - Unable to dvd or cdrom-boot DomU after xen-tools update\n      Fixed with update to Xen version 4.1.4\n    * bnc#800156 - L3: HP iLo Generate NMI function not working in XEN\n      kernel\n    * Upstream patches from Jan 26404-x86-forward-both-NMI-kinds.patch\n      26427-x86-AMD-enable-WC+.patch\n    * bnc#793927 - Xen VMs with more than 2 disks randomly fail to start\n    * Upstream patches from Jan 26332-x86-compat-show-guest-stack-mfn.patch\n      26333-x86-get_page_type-assert.patch (Replaces\n      CVE-2013-0154-xsa37.patch)\n      26340-VT-d-intremap-verify-legacy-bridge.patch (Replaces\n      CVE-2012-5634-xsa33.patch) 26370-libxc-x86-initial-mapping-fit.patch\n    * Update to Xen 4.1.4 c/s 23432\n    * Update xenpaging.guest-memusage.patch add rule for xenmem to avoid\n      spurious build failures\n    * Upstream patches from Jan 26179-PCI-find-next-cap.patch\n      26183-x86-HPET-masking.patch 26188-x86-time-scale-asm.patch\n      26200-IOMMU-debug-verbose.patch 26203-x86-HAP-dirty-vram-leak.patch\n      26229-gnttab-version-switch.patch (Replaces\n      CVE-2012-5510-xsa26.patch) 26230-x86-HVM-limit-batches.patch\n      (Replaces CVE-2012-5511-xsa27.patch)\n      26231-memory-exchange-checks.patch (Replaces\n      CVE-2012-5513-xsa29.patch) 26232-x86-mark-PoD-error-path.patch\n      (Replaces CVE-2012-5514-xsa30.patch) 26233-memop-order-checks.patch\n      (Replaces CVE-2012-5515-xsa31.patch)\n      26235-IOMMU-ATS-max-queue-depth.patch\n      26272-x86-EFI-makefile-cflags-filter.patch\n      26294-x86-AMD-Fam15-way-access-filter.patch CVE-2013-0154-xsa37.patch\n    * Restore c/s 25751 in 23614-x86_64-EFI-boot.patch. Modify the EFI\n      Makefile to do additional filtering.\n\nSecurity Issue references:\n\n    * CVE-2013-0153\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0153\u003e\n    * CVE-2012-6075\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075\u003e\n    * CVE-2012-5634\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5634\u003e\n\n","status":"published","published":"2013-03-13T11:27:38Z","modified":"2026-02-04T04:06:10.61132Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1152-1","title":"Security update for kvm","description":"\nkvm has been updated to fix issues in the embedded qemu:\n\n    * \n\n      CVE-2014-0223: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could potentially have\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\n    * \n\n      CVE-2014-3461: A user able to alter the savevm data (either on the\n      disk or over the wire during migration) could have used this flaw to\n      to corrupt QEMU process memory on the (destination) host, which could\n      have potentially resulted in arbitrary code execution on the host\n      with the privileges of the QEMU process.\n\n    * \n\n      CVE-2014-0222: An integer overflow flaw was found in the QEMU block\n      driver for QCOW version 1 disk images. A user able to alter the QEMU\n      disk image files loaded by a guest could have used this flaw to\n      corrupt QEMU process memory on the host, which could have potentially\n      resulted in arbitrary code execution on the host with the privileges\n      of the QEMU process.\n\nNon-security bugs fixed:\n\n    * Fix exceeding IRQ routes that could have caused freezes of guests.\n      (bnc#876842)\n    * Fix CPUID emulation bugs that may have broken Windows guests with\n      newer -cpu types (bnc#886535)\n\nSecurity Issues:\n\n    * CVE-2014-0222\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222\u003e\n    * CVE-2014-0223\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223\u003e\n    * CVE-2014-3461\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461\u003e\n\n","status":"published","published":"2014-09-19T14:41:45Z","modified":"2026-02-04T03:41:35.653354Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-3456","description":"The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.","status":"published","published":"2015-05-13T00:00:00Z","modified":"2026-04-22T10:08:02.156597Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2608-1","title":"qemu, qemu-kvm vulnerabilities","description":"Jason Geffner discovered that QEMU incorrectly handled the virtual floppy\ndriver. This issue is known as VENOM. A malicious guest could use this\nissue to cause a denial of service, or possibly execute arbitrary code on\nthe host as the user running the QEMU process. In the default installation,\nwhen QEMU is used with libvirt, attackers would be isolated by the libvirt\nAppArmor profile. (CVE-2015-3456)\n\nDaniel P. Berrange discovered that QEMU incorrectly handled VNC websockets.\nA remote attacker could use this issue to cause QEMU to consume memory,\nresulting in a denial of service. This issue only affected Ubuntu 14.04\nLTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779)\n\nJan Beulich discovered that QEMU, when used with Xen, didn't properly\nrestrict access to PCI command registers. A malicious guest could use this\nissue to cause a denial of service. This issue only affected Ubuntu 14.04\nLTS and Ubuntu 14.10. (CVE-2015-2756)\n","status":"published","published":"2015-05-13T17:13:44Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}