Nexus 5 won't get N, but how long will it get 6.x sec updates?

[gizmo21]

Anyone with more detailed info than this:
https://support.google.com/nexus/answer/4457705#nexus_devices

Nexus devices get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer.

Is the last sec update patch August 2016 or Sept. or Oct.?

 

[Guille Barfer]

According Google, Nexus devices will receive at least three years of security update since its release. The Nexus 5 appeared on November 2013, so we should get the security patches at least until November 2016. After November, Google may continue updating this phone or maybe not, nobody knows.

 

[gizmo21]

Well at least the september updates are now here OTA

 

[RealDogBoy]

... or at least 18 months from when the Google Store last sold the device, whichever is longer.

Does anybody know when the N5 was last sold by the Google Store?

 

[tmeader]

Looks like it was around March 2015:

It’s official: Nexus 5 is out of the Google Store for good

So, given the 3 year timetable, guessing November will be the last.

 

[RealDogBoy]

Looks like it was around March 2015:

It’s official: Nexus 5 is out of the Google Store for good

So, given the 3 year timetable, guessing November will be the last.

Thanks for the info -- but I'm sorry to hear that. I like my Nexus 5 and not having security updates will make me less likely to keep it in service. :-\

 

[Rukbat]

A lot of the "security updates" never affect anyone not going to dicey sites. (The only security updates I have are Malwarebytes and an antivirus, on 4.4.2 - but I don't go to questionable sites.)

 

[gizmo21]

So October 16 still came in: https://developers.google.com/android/nexus/images#hammerhead

 

[gizmo21]

In November updates there are mentions of the Nexus 5 beeing vulnerable:

All Google devices: If an issue affects all Nexus and Pixel devices, the table will have "All" in the Updated Google devices column. "All" encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Android One, Nexus Player, Pixel C, Pixel, and Pixel XL.

CVE References Severity Updated Google devices Updated AOSP versions Date reported
CVE-2016-6704 A-30229821 [2] [3] High All 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 19, 2016
CVE-2016-6705 A-30907212 [2] High All 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Aug 16, 2016
CVE-2016-6707 A-31350622 High All 6.0, 6.0.1, 7.0 Sep 7, 2016
CVE-2016-6709 A-31081987 High All 6.0, 6.0.1, 7.0 Oct 9, 2015
CVE-2016-6710 A-30537115 [2] High All 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jul 30, 2016
CVE-2016-6713 A-30822755 High All 6.0, 6.0.1, 7.0 Aug 11, 2016
CVE-2016-6714 A-31092462 High All 6.0, 6.0.1, 7.0 Aug 22, 2016
CVE-2016-6715 A-29833954 Moderate All 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 Jun 28, 2016

CVE-2016-6728 A-30400942* Critical Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One Jul 25, 2016

So hopefully that November update still will arrive, as it is not here atm:
https://developers.google.com/android/images#hammerhead

 

[electronicwiz1]

They would probably have updated it by now, if they were going to update it..

 

[RealDogBoy]

I'm not sure any of the November updates are out yet. I have a Nexus 6 (definitely still within the security update period) and it hasn't gotten a Nov., 2016 OTA.

 

[patruns]

I was just going to post the same question. It's November 22nd and I still have not received an update. Surprisingly, my wife did a few days ago on her Nexus 5.

Update: Looked at wife's phone and her last update is the October one. She only recently installed it. Looks like we are finished. Very surprised that Google would cut off security updates. O/S updates I could understand, but not security updates.

 

[RealDogBoy]

I was just going to post the same question. It's November 22nd and I still have not received an update. Surprisingly, my wife did a few days ago on her Nexus 5.

That's good news -- the update exists and the only question is when do we get it.

 

[RealDogBoy]

My Nexus 5 got an OTA security update today (1/5/17) -- which surprised me since I thought it wasn't going to get any more updates. But then I checked "settings>about phone>Android security patch level" -- I noticed that the date is still October 5, 2016 (unchanged).

So was this a patch of the October 5, 2016 patch?

 

[gizmo21]

I just saw there is an factory image of december: 6.0.1 (M4B30Z, Dec 2016)
https://developers.google.com/android/images#hammerhead

Hope to get notification soon.

 

[RealDogBoy]

I just saw there is an factory image of december: 6.0.1 (M4B30Z, Dec 2016)
https://developers.google.com/android/images#hammerhead

Hope to get notification soon.

Thanks for that.

I'm puzzled that they skipped the November update but still are doing updates. I had thought that 10/5/2016 would be the last one.

 

[gizmo21]

Updated today:
Sec Patch Level: still Oct 5th
Build-Number: M4B30Z (oktober was M4B30X)

Kind of puzzling why they have have not leveled up the sec patch date but perhaps not all sec patches were included.
Also discussed on XDA and the diff posted on page 3 showing that at least something was updated so one can hope some more vulnerabilities are fixed:
https://forum.xda-developers.com/go...tory-image-m4b30z-android-6-0-1-dec-t3515165/

Or they just forgot it:
https://groups.google.com/forum/m/?hl=en#!topic/android-building/oICVRiWYPAg

 

[RealDogBoy]

Updated today:
Sec Patch Level: still Oct 5th
Build-Number: M4B30Z (oktober was M4B30X)

Kind of puzzling why they have have not leveled up the sec patch date but perhaps not all sec patches were included.
Also discussed on XDA and the diff posted on page 3 showing that at least something was updated so one can hope some more vulnerabilities are fixed:
https://forum.xda-developers.com/go...tory-image-m4b30z-android-6-0-1-dec-t3515165/

Or they just forgot it:
https://groups.google.com/forum/m/?hl=en#!topic/android-building/oICVRiWYPAg

Thanks for those links.

It looks like the recent update is based on the December, 2016 patches, although it's a month late and the patch level is (erroneously) labeled October 5, 2016.

But any patches are better than none at all.

 

[patruns]

Mine just got the "October 5, 2016" security update yesterday as well. I was reluctant to let it update but bit the bullet. Driving in the car this morning my phone suddenly rebooted and killed the bluetooth connections. I guess the car system was trying to re-pair after it started and I kept getting notifications to plug in a code to reconnect. As I was driving I just ignored it. Will have to reconnect it later. I hope this new "patch" is not introducing new bluetooth issues.

Update: Sure enough, new bluetooth problems. Had to re-pair it with the car's system. Not an easy task with a Honda. Go back out later to the car and while it shows as paired in the phone's settings, it is not connected.. Had to re-pair again. This happens every time I start the car now. The only time I had zero problems was when I first got the phone with Kit Kat. Wish I had never done any updates.

Issue has been reported as #231895

 

[Pieter Nemegeer]

i'm definitly not updating... don't care about security... only a working phone is what i care about
i've never heard of anyone that got into trouble because of those 'security risks'