qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands

The Xen Project reports:

A heap overflow flaw was found in the way QEMU’s IDE subsystem
handled I/O buffer access while processing certain ATAPI
commands.
A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host’s QEMU process corresponding to
the guest.