CVE-2015-3456

Description

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Affected packages (6)

• Debian/qemufrom 0, < 1:2.3+dfsg-3
• Debian/qemufrom 0, < 0.12.5+dfsg-3squeeze5
• Debian/qemu-kvmfrom 0, < 0.12.5+dfsg-5+squeeze12
• Debian/virtualboxfrom 0, < 4.1.18-dfsg-2+deb7u5
• Debian/xenfrom 0, < 4.4.0-1
• Debian/xenfrom 0, < 4.1.4-3+deb7u6

References (1)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-3456