VENOM
QEMU buffer overflow in the floppy disk controller (CVE-2015-3456 aka VENOM)
It was discovered that a buffer overflow existed in the virtual floppy disk controller of QEMU. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host's QEMU process.
This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack's use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an AppArmor profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment's attack surface.
A fix for this issue has been committed in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. The Ubuntu Security Team is in the process of testing updated packages. Ubuntu security updates will be be available after testing is complete. The Ubuntu Security Team will update this page when updates are available.
Timeline
2015 Apr 30: The Ubuntu Security Team is notified by CrowdStrike via the linux-distros list, with a pending CRD of 2015-05-13 12:00 UTC
2015 May 13: Issue became public a few hours before the CRD via twitter and reddit with links to CrowdStrike's VENOM page
2015 May 13: CrowdStrike sent a notification email to the oss-security mailing list
Public Cloud Archive updates
Ubuntu Cloud Archive Packages: <IN PROGRESS>