command-injection

Code rides the error channel

A compromised Qubes qube can inject commands into dom0 via the filename in a qvm-copy-to-vm error message. QSB-118 patches it in 4.3.22.