It is applicable to the following patch-levels: 6.
It addresses the following problem:

Program component:  qemu-kvm
Reference:          CVE-2012-6075, CVE-2014-0150, CVE-2014-2894, CVE-2013-4344, CVE-2014-0142, CVE-2014-0143, CVE-2014-0144, CVE-2014-0145, CVE-2014-0146, CVE-2014-0147, CVE-2014-0223, CVE-2014-0222, CVE-2014-3640, CVE-2014-3689, CVE-2014-7815, CVE-2014-8106, CVE-2014-3615, CVE-2015-3456, CVE-2015-4037, CVE-2015-3209, bug 33279
Fixed version:      1.1.2+dfsg-6.29.46.201506231342

These vulnerabilities have been fixed in qemu-kvm:
* Buffer overflow in the e1000 driver (CVE-2012-6075)
* Buffer overflow in virtio-net (CVE-2014-0150)
* Buffer overflow in processing SMART commands in the emulated IDE adaptor
  (CVE-2014-2894)
* Buffer overflow in the SCSI implementation in QEMU (CVE-2013-4344)
* Denial of service through division by zero in parallels driver
  (CVE-2014-0142)
* Integer overflows in various block drivers (CVE-2014-0143)
* Memory corruption in various block drivers (CVE-2014-0144)
* Buffer overflows in block drivers (CVE-2014-0145)
* NULL pointer dereference in qcow driver (CVE-2014-0146)
* Missing input sanitising in qcow driver (CVE-2014-0147)
* Out of bounds access in parsing qcow1 images (CVE-2014-0223, CVE-2014-0222)
* NULL pointer dereference in SLIRP (CVE-2014-3640)
* vmware_vga: insufficient parameter validation in rectangle functions
  (CVE-2014-3689)
* Missing sanitising of the bits_per_pixel value in the VNC display driver
  (CVE-2014-7815)
* Missing access checks in the Cirrus VGA emulator may result in privilege
  escalation (CVE-2014-8106)
* VGA emulator in QEMU allows local guest users to read host memory by
  setting the display to a high resolution (CVE-2014-3615)
* Virtualized Environment Neglected Operations Manipulation (VENOM)
  in QEMU's virtual Floppy Disk Controller (CVE-2015-3456)
* Denial of service due to insecure temporary file use in /net/slirp.c
  (CVE-2015-4037)
* A privileged guest user in a guest with an AMD PCNet ethernet card enabled
  can potentially use this flaw to execute arbitrary code on the host with
  the privileges of the hosting QEMU process (CVE-2015-3209)

We recommend to update your UCS installation. Updated packages are
available in the Univention online repository, which is automatically
added to the apt packages sources. The following procedures can be
used to update a UCS installation:

1. A single system can be updated in the web interface of the
Univention Management Console through the "Software update" module.

2. A single system can be updated on the command line by running the
command "univention-upgrade"

3. Multiple systems can be updated through a maintenance policy.