diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
index be0757ecfc..da4c1e25d8 100644
--- a/tools/libxl/libxl_dm.c
+++ b/tools/libxl/libxl_dm.c
@@ -63,6 +63,20 @@ const char *libxl__domain_device_model(libxl__gc *gc,
     return dm;
 }
 
+/* XSA-180 / CVE-2014-3672
+ *
+ * The QEMU shipped with Xen has a bodge. It checks for
+ * XEN_QEMU_CONSOLE_LIMIT to see how much data QEMU is allowed
+ * to write to stderr. We set that to 1MB if it is not set by
+ * system administrator.
+ */
+static void libxl__set_qemu_env_for_xsa_180(libxl__gc *gc,
+                                            flexarray_t *dm_envs)
+{
+    if (getenv("XEN_QEMU_CONSOLE_LIMIT")) return;
+    flexarray_append_pair(dm_envs, "XEN_QEMU_CONSOLE_LIMIT", "1048576");
+}
+
 const libxl_vnc_info *libxl__dm_vnc(const libxl_domain_config *guest_config)
 {
     const libxl_vnc_info *vnc = NULL;
@@ -1144,7 +1158,8 @@ void libxl__spawn_local_dm(libxl__egc *egc, libxl__dm_spawn_state *dmss)
     char *path, *logfile;
     int logfile_w, null;
     int rc;
-    char **args, **arg;
+    flexarray_t *dm_envs;
+    char **args, *const *envs, **arg;
     xs_transaction_t t;
     char *vm_path;
     char **pass_stuff;
@@ -1171,6 +1186,10 @@ void libxl__spawn_local_dm(libxl__egc *egc, libxl__dm_spawn_state *dmss)
         goto out;
     }
 
+    dm_envs = flexarray_make(gc, 16, 1);
+    libxl__set_qemu_env_for_xsa_180(gc, dm_envs);
+    envs = (char**) flexarray_contents(dm_envs);
+
     if (b_info->type == LIBXL_DOMAIN_TYPE_HVM) {
         path = xs_get_domain_path(ctx->xsh, domid);
         libxl__xs_write(gc, XBT_NULL,
@@ -1248,7 +1267,7 @@ retry_transaction:
         goto out_close;
     if (!rc) { /* inner child */
         setsid();
-        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, NULL);
+        libxl__exec(gc, null, logfile_w, logfile_w, dm, args, envs);
     }
 
     rc = 0;