- XSA-198 CVE-2016-9379 CVE-2016-9380
  delimiter injection vulnerabilities in pygrub

- XSA-197 CVE-2016-9381
  qemu incautious about shared ring processing

- XSA-196 CVE-2016-9377 CVE-2016-9378
  x86 software interrupt injection mis-handled

- XSA-195 CVE-2016-9383
  x86 64-bit bit test instruction emulation broken

- XSA-194 CVE-2016-9384
  guest 32-bit ELF symbol table load leaking host data

- XSA-193 CVE-2016-9385
  x86 segment base write emulation lacking canonical address checks

- XSA-192 CVE-2016-9382
  x86 task switch to VM86 mode mis-handled

- XSA-191 CVE-2016-9386
  x86 null segments not always treated as unusable

fixes #6495