On the 1st of June, a security release was made for the Tor daemon. This is version 0.4.9.9, see official change logs. This release fixes several high severity issues, including memory safety issues such as use-after-free bugs. It can be assumed that, with enough effort, these can be exploited to gain remote code execution in Whonix-Gateway, compromising all anonymity.
On 4th of June, Tails released an emergency release with upgraded Tor daemon. This is version 7.8.1. See Tor blog.
Today, three weeks later, Whonix, at least in QubesOS, is still running with the vulnerable version 0.4.9.8.
I rely on Whonix for strong anonymity, and still running a release with publicly disclosed memory safety vulnerabilities makes me very uneasy. The lack of communication about the delay too.
What is the status for the update? When can we expect it? And what is the cause of the delay?
At the time of writing (2026-06-26), no Debian package for Tor 0.4.9.9 is available from the Tor Project’s Debian repository for Tor (Index of /torproject.org/pool/main/t/tor). This is where we get our Tor binaries from, therefore if the Tor Project does not publish new packages, we will not get them. EDIT: I failed to search the linked page properly, 0.4.9.11 is available from that repository.
4 VMs of mine all have stable installed. The high-priority security issues addressed by ryrona are not fixed in stable. Whonix VM are indeed vulnerable to them for 3 weeks under default settings?
apt policy tor shows that 0.4.9.11-1~bpo13+1 in backport repo is available but not selected ***
@numagoz If you got backports selected, why you got 0.4.9.9-1 and not 0.4.9.11-1? Maybe because of this?
Migration status for tor (0.4.9.9-1 to 0.4.9.11-1): Waiting for test results or another package, or too young (no action required now - check later)
@Patrick Can Whonix make Debian backport the default repo for tor updates? The update and upgrade button in sysmaint select the stable repo for tor at the moment. At least for 4 of my GW VMs
Tails indeed shipped an emergency release at 4 June
This release is an emergency release to fix a serious security vulnerability in the Linux kernel, as well as security vulnerabilities in the Tor client.
Update the Tor client to 0.4.9.9, which fixes several security vulnerabilities.
Okay, so what does this mean? Is it some automatic import script that is broken? Because it looks like only version 0.4.9.6 is available through KickSecure repositories (see post right above this one), and the Tor repositories are not added as default on Whonix-Gateway for QubesOS.
Do I need to create some ticket somewhere, or is there some ticket I can track?
You have to install tor from this repository. Debian backports. sudo apt install tor=0.4.9.11-1~bpo13+1
Whonix can’t assume that everyone is going to do this and keep track of high-severity tor updates all the time. Can Debian Backports set default for tor.
EDIT: Maybe Trixie Security get security updates before backports in some cases. The tor update of yesterday are added to the Debian backports repo within hours
We intentionally keep forum posts deduplicated so they can function as such.