Qubes Security Bulletin #26

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear Qubes users,

We have just released a new Qubes Security Bulletin (QSB #26):

https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-026-2016.txt

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJX4siDAAoJENtN07w5UDAwY94QAIB3C4K5Mt5CvP8T0Uh7sCl5
g6NwXDicKsQ2MX+VRGKNSfoGs3C2Hu6DlMWB//WTpGXpmp5TKqrOf/jyNjfjNOBD
6XiCxjBlb6aDybQ1FEmpGlrP3QMQ2vqSTtUYweR3WOM1kkeqliRZJl9Swa/XMtwr
m0fm3/qx1E6D8LUf2wJNrDw5dCAOs4S6ePsu5bOMKEoiUYFBpeYJFDmVRUZSsqlX
ZYjL5r3accFQ00qteRb1GOKVIfZ9PQCM4xS+e/1JITRMfFvoLLrzSu9RarUia1df
2UEYCA9Ttc689hCaqRZeoTlrCwfAUYyhZI8tSO+fhlwZ1lqzvPJn2ulVJcEnTfkH
5+n4voVyrUukSrKtByXyPWVfbYKv9pX/L35N8x7k5E+emXfjDL/kl09X6pGIHEE5
AQQ3Ja8kZDEy2r9PBqkmrVm6X8xLUD5FmqSb9cP7aMdlvIbjyvI7DYMernv2M7Eg
MtXjIjBTidMzIzJVVSFvHDXNDVcbjx6B8SzGz6xzXzOcJ0oU9wLn5sHcH/1sNl/W
zIxejQUrjgX3fmhC83WdgQNxOUJRFd2yEtWT8Tm4SEvBHOJtPQolTtuQzMALHX0r
Kg4c0lDQI4CNeK0U70aVrVH3xe7nSFJVI/awFNU+zQYh7XOoL6gWdQyOfLdVyEyT
MzCjmgULDcz2wQ4O7alf
=RQqL
-----END PGP SIGNATURE-----

[Vít Šesták]

On Qubes 3.2, I have qubes-gui-dom0 and no update is available through qubes-dom0-update.

BTW, after the update, is itt enough to kill (and restart by some command) all guid processes?

[Chris Laprise]

On 09/22/2016 01:11 PM, Vít Šesták wrote:
> On Qubes 3.2, I have qubes-gui-dom0 and no update is available through qubes-dom0-update.
>
> BTW, after the update, is itt enough to kill (and restart by some command) all guid processes?
>

I haven't seen the update, either.

Chris

[HW42]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Chris Laprise:

> On 09/22/2016 01:11 PM, Vít Šesták wrote:
>> On Qubes 3.2, I have qubes-gui-dom0 and no update is available
>> through qubes-dom0-update.
>>
>> BTW, after the update, is itt enough to kill (and restart by some
>> command) all guid processes?

I think yes.

> I haven't seen the update, either.

I got the update. Try:

sudo qubes-dom0-update --enablerepo=qubes-dom0-security-testing --clean

But I also experienced (caching?) problems in the past strange, see [0].

[0]: https://groups.google.com/d/msgid/qubes-devel/113f7c74-5714-18ca-3a09-6dc69ad3528d%40ipsumj.de
-----BEGIN PGP SIGNATURE-----

iQIsBAEBCgAWBQJX5B4JDxxodzQyQGlwc3Vtai5kZQAKCRDkrMknimRoFqtlD/9/
LtnpeAkBdcNPF/7rAIcs2IEExUMJIu9UtJtMmoW6iXQ2L85Qg+wJNUBA8+1m6JLS
88kHEsff8JLPXMfZuebKwosY9xziUrniGPT+Md6LiyMO/JOQhkQMg2gAUysYEJgn
dNR1KXIFOuT0lcG0liBJnoAE3Xjia3TNYqN8/YyV8v3IxtedLYU/5X3Ut2zDn6DI
uNsPiAV8uW1v0aFcuLOIXNZ62C6mIH7yvHncng/Z29NhWXGOci58CrxxAvL0J/Nn
VxCSJT4Eq5jg0U9mjQUKJMDm++cSkwC1k9UaCErTEG1RTgiJKjy3RKVxp2qbMg+6
xsava5R7wHJG0xGZDZwhIE/tO9Gi4qjUk3ylI/WMu/mbPV/D5Yow/k9q7HQJ2t0X
SkXD78xgZIK4EWNmSOY22RZNRXV1GjjwhQcpyQ9gM7mXAsFkuQYJlTYeDb7v2vrI
9QWWc703U+d5xfyfj1QUTf1E7CP+eYRLUNlpcy2LiHyuJGDkPLntV0B9JL24aun4
nPZDkxfUV9jKe0LXuh+V4mP/T+DUoRgiaU76c56idjAzYodP+Hxs6W0gwIwkLQrg
EWnfWM7ozIzZ9qcCaNtcwr4udhiBNTYVexJKa5iq+Ki3Fd2gQTBOjtHFWRk50V1N
I1LrXwf295BQ1vdzyjhoZtuibvhpzjIvx8aRUblldw==
=P1fw
-----END PGP SIGNATURE-----

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Please note that the package is in the security-testing repo, not the
stable repo.

The standard procedure when releasing a new security fix is to put the
package in the security-testing repo for a brief period of time prior
to moving it to the stable repo. However, the bugs reported in some
other recent QSBs have been so severe that this usual procedure was
circumvented. Since packages have recently been skipping the
security-testing repo, you may have expected this package to skip it
too, but since this bug is not as severe as the others, we're sticking
with the standard procedure for this one.

As Simon pointed out, you can enable the security-testing repo like so:

$ sudo qubes-dom0-update --enablerepo=qubes-dom0-security-testing

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJX5FOrAAoJENtN07w5UDAwCjgP/3TRyrxAiw6RXnD3rQGnOiMm
Z3bWUuQk5JQXI0ATLtz4ILqCdIJw49DYX1vFAdjpcvWS3VUPPY/sG92H3qV076Z+
K+GjbzoK7eqgpJPdLbe7f9B+R/eN1LU90lFCNAJvk1vzqrMiLph5BL3FEGnlJIe+
PeqB26R9GkctWhhUSLtfRxge7OZOlxj74QSp8Da2stKXy9j0oyhjng9V4oEWzAad
eboMI6iOOma1TzRJ0c/2ehbcBaehsmFEPFrX2vi01ImT842giAJcK9HBHoJ3Oxrp
a13OZvVSzxRkx2mZepFNl926fje/Of2xS5flRHQmWrnklIuPZjYfFaJJ82fFdRg2
4u2Y7DYiryh8VoSd760JhO5xwJAOfv7tOyArEKOjHO/VW+3nv1daA5p+tUnddeKa
EhzV99is1ZNsuT8rrOBdr0vtsQHdM0PQ0lzZbd/bXzLkgbGI9KJ+C0OZ+xlaIN2E
QSkGFOMYRh2al9OAlFFjhb5Vco7VZOl/xgtgmN7VBHsb7ZyoVzapvV60XhkKQgT2
mRC6GEZHFoxOtF2FC/nN3hBU/TuAl6citLO5KTG5vOHFbz2TC95657IzmyBN028p
NoMnWvIGhE+xU9hVYvQNVQmFGA0YocbQeTcUemC13pKC52RY2+iOGA1vl9NtB5JV
FWL0gOKWIgsG/Au4+q8/
=1HkM
-----END PGP SIGNATURE-----