We have publishedQubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions.
Source:qsb-118-2026.txt.sig.marmarek
The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published.
AQubes security bulletin (QSB)is a security announcement issued by theQubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them.
QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed byupdating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs.
APGPsignature is a cryptographicdigital signaturemade in accordance with theOpenPGPstandard. PGP signatures can be cryptographically verified with programs likeGNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures.
A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project.
The following command-line instructions assume a Linux system withgitandgpginstalled. (For Windows and Mac options, seeOpenPGP software.)
For this announcement (QSB-118), the commands are:
You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-118 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.