Qubes Security Bulletin 118 Addresses Arbitrary Code Execution Vulnerability

The Qubes security team has published Qubes Security Bulletin (QSB) 118, which addresses an arbitrary code execution vulnerability in the qvm-copy-to-vm error reporting feature. This bulletin includes a summary and impact analysis of the vulnerability, along with details on how to patch it. QSBs inform the Qubes community about necessary actions to protect against recently-discovered security vulnerabilities. Typically, these vulnerabilities are addressed through standard updates, but some may require special user actions, which are detailed in the QSBs. The bulletin emphasizes the importance of verifying the authenticity of QSBs using PGP signatures to avoid potential security risks from forged announcements. Users are advised to authenticate the Qubes Master Signing Key (QMSK) out-of-band to ensure its legitimacy. The bulletin provides command-line instructions for Linux users to verify the QMSK and import associated PGP keys. Users can also verify signatures directly from the announcement text.