These security issues were fixed: - CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386). - CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385). - CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787). - CVE-2015-5261: Host memory access from guest using crafted images (bsc#948976).