Vulnerabilites related to torproject - tor
CVE-2022-33903 (GCVE-0-2022-33903)
Vulnerability from cvelistv5
Published
2022-07-17 00:00
Modified
2024-08-03 08:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:09:22.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2022-33903"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-03T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2022-33903"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-33903",
"datePublished": "2022-07-17T00:00:00",
"dateReserved": "2022-06-17T00:00:00",
"dateUpdated": "2024-08-03T08:09:22.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10592 (GCVE-0-2020-10592)
Vulnerability from cvelistv5
Published
2020-03-23 12:16
Modified
2024-08-04 11:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:10.160Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33120"
},
{
"name": "GLSA-202003-50",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-31T17:05:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33120"
},
{
"name": "GLSA-202003-50",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10592",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/33120",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/33120"
},
{
"name": "GLSA-202003-50",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10592",
"datePublished": "2020-03-23T12:16:48",
"dateReserved": "2020-03-15T00:00:00",
"dateUpdated": "2024-08-04T11:06:10.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34550 (GCVE-0-2021-34550)
Vulnerability from cvelistv5
Published
2021-06-29 11:11
Modified
2024-08-04 00:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:12:50.393Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-10T04:06:18",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-34550",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392"
},
{
"name": "https://blog.torproject.org/node/2041",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-25"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-34550",
"datePublished": "2021-06-29T11:11:45",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-08-04T00:12:50.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10593 (GCVE-0-2020-10593)
Vulnerability from cvelistv5
Published
2020-03-23 12:22
Modified
2024-08-04 11:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:10.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33619"
},
{
"name": "GLSA-202003-50",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-31T17:05:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33619"
},
{
"name": "GLSA-202003-50",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10593",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/33619",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/33619"
},
{
"name": "GLSA-202003-50",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"name": "openSUSE-SU-2020:0406",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"name": "openSUSE-SU-2020:0428",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10593",
"datePublished": "2020-03-23T12:22:03",
"dateReserved": "2020-03-15T00:00:00",
"dateUpdated": "2024-08-04T11:06:10.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-0490 (GCVE-0-2018-0490)
Vulnerability from cvelistv5
Published
2018-03-05 15:00
Modified
2024-08-05 03:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- NULL pointer dereference
Summary
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.607Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25074"
},
{
"name": "DSA-4183",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4183"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor"
}
]
}
],
"datePublic": "2018-03-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "NULL pointer dereference",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-29T09:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25074"
},
{
"name": "DSA-4183",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4183"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0490",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "Tor"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "NULL pointer dereference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/25074",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/25074"
},
{
"name": "DSA-4183",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4183"
},
{
"name": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0490",
"datePublished": "2018-03-05T15:00:00",
"dateReserved": "2017-11-27T00:00:00",
"dateUpdated": "2024-08-05T03:28:10.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-2929 (GCVE-0-2015-2929)
Vulnerability from cvelistv5
Published
2020-01-24 17:22
Modified
2024-08-06 05:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Denial of Service - Malformed Input
Summary
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tor Project | Tor |
Version: before 0.2.4.27 Version: 0.2.5.x before 0.2.5.12 Version: 0.2.6.x before 0.2.6.7 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:32:20.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15601"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "The Tor Project",
"versions": [
{
"status": "affected",
"version": "before 0.2.4.27"
},
{
"status": "affected",
"version": "0.2.5.x before 0.2.5.12"
},
{
"status": "affected",
"version": "0.2.6.x before 0.2.6.7"
}
]
}
],
"datePublic": "2015-04-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of Service - Malformed Input",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-24T17:22:27",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15601"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-2929",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "before 0.2.4.27"
},
{
"version_value": "0.2.5.x before 0.2.5.12"
},
{
"version_value": "0.2.6.x before 0.2.6.7"
}
]
}
}
]
},
"vendor_name": "The Tor Project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service - Malformed Input"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://openwall.com/lists/oss-security/2015/04/06/5",
"refsource": "MISC",
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/15601",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/15601"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-2929",
"datePublished": "2020-01-24T17:22:27",
"dateReserved": "2015-04-06T00:00:00",
"dateUpdated": "2024-08-06T05:32:20.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0375 (GCVE-0-2017-0375)
Vulnerability from cvelistv5
Published
2017-06-09 17:00
Modified
2024-08-05 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- reachable assertion
Summary
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Tor before 0.3.0.8 |
Version: Tor before 0.3.0.8 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:57.084Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22493"
},
{
"name": "99017",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99017"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor before 0.3.0.8",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor before 0.3.0.8"
}
]
}
],
"datePublic": "2017-06-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "reachable assertion",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-14T09:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22493"
},
{
"name": "99017",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99017"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0375",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor before 0.3.0.8",
"version": {
"version_data": [
{
"version_value": "Tor before 0.3.0.8"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "reachable assertion"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/22493",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/22493"
},
{
"name": "99017",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99017"
},
{
"name": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html",
"refsource": "CONFIRM",
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"name": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7",
"refsource": "CONFIRM",
"url": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0375",
"datePublished": "2017-06-09T17:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:57.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-9079 (GCVE-0-2016-9079)
Vulnerability from cvelistv5
Published
2018-06-11 21:00
Modified
2025-07-30 01:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Use-after-free in SVG Animation
Summary
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Mozilla | Firefox |
Version: unspecified < 50.0.2 |
|||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:42:10.169Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3730",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2016/dsa-3730"
},
{
"name": "RHSA-2016:2843",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html"
},
{
"name": "GLSA-201701-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-35"
},
{
"name": "1037370",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1037370"
},
{
"name": "42327",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/42327/"
},
{
"name": "RHSA-2016:2850",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2016-92/"
},
{
"name": "94591",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94591"
},
{
"name": "GLSA-201701-15",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"name": "41151",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41151/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2016-9079",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T12:50:20.570667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2023-06-22",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-30T01:46:14.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"timeline": [
{
"lang": "en",
"time": "2023-06-22T00:00:00+00:00",
"value": "CVE-2016-9079 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "50.0.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "45.5.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "45.5.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2016-11-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox \u003c 50.0.2, Firefox ESR \u003c 45.5.1, and Thunderbird \u003c 45.5.1."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Use-after-free in SVG Animation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-12T09:57:01.000Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"name": "DSA-3730",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2016/dsa-3730"
},
{
"name": "RHSA-2016:2843",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html"
},
{
"name": "GLSA-201701-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-35"
},
{
"name": "1037370",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1037370"
},
{
"name": "42327",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/42327/"
},
{
"name": "RHSA-2016:2850",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2016-92/"
},
{
"name": "94591",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94591"
},
{
"name": "GLSA-201701-15",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"name": "41151",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/41151/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2016-9079",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Firefox",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "50.0.2"
}
]
}
},
{
"product_name": "Firefox ESR",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "45.5.1"
}
]
}
},
{
"product_name": "Thunderbird",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "45.5.1"
}
]
}
}
]
},
"vendor_name": "Mozilla"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox \u003c 50.0.2, Firefox ESR \u003c 45.5.1, and Thunderbird \u003c 45.5.1."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Use-after-free in SVG Animation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3730",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2016/dsa-3730"
},
{
"name": "RHSA-2016:2843",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html"
},
{
"name": "GLSA-201701-35",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-35"
},
{
"name": "1037370",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1037370"
},
{
"name": "42327",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42327/"
},
{
"name": "RHSA-2016:2850",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2016-92/",
"refsource": "CONFIRM",
"url": "https://www.mozilla.org/security/advisories/mfsa2016-92/"
},
{
"name": "94591",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94591"
},
{
"name": "GLSA-201701-15",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"name": "41151",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/41151/"
},
{
"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066",
"refsource": "CONFIRM",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2016-9079",
"datePublished": "2018-06-11T21:00:00.000Z",
"dateReserved": "2016-10-27T00:00:00.000Z",
"dateUpdated": "2025-07-30T01:46:14.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28090 (GCVE-0-2021-28090)
Vulnerability from cvelistv5
Published
2021-03-19 04:19
Modified
2024-08-03 21:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:33:17.495Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40316"
},
{
"name": "FEDORA-2021-e68317166d",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-10T04:06:15",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40316"
},
{
"name": "FEDORA-2021-e68317166d",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-28090",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316"
},
{
"name": "https://blog.torproject.org/node/2009",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/node/2009"
},
{
"name": "https://bugs.torproject.org/tpo/core/tor/40316",
"refsource": "CONFIRM",
"url": "https://bugs.torproject.org/tpo/core/tor/40316"
},
{
"name": "FEDORA-2021-e68317166d",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-25"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-28090",
"datePublished": "2021-03-19T04:19:06",
"dateReserved": "2021-03-08T00:00:00",
"dateUpdated": "2024-08-03T21:33:17.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-2688 (GCVE-0-2015-2688)
Vulnerability from cvelistv5
Published
2020-01-24 17:46
Modified
2024-08-06 05:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Other
Summary
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tor Project | Tor |
Version: before 0.2.4.26 Version: 0.2.5.x before 0.2.5.11 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:38.426Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15083"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "The Tor Project",
"versions": [
{
"status": "affected",
"version": "before 0.2.4.26"
},
{
"status": "affected",
"version": "0.2.5.x before 0.2.5.11"
}
]
}
],
"datePublic": "2015-03-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-24T17:46:21",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15083"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-2688",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "before 0.2.4.26"
},
{
"version_value": "0.2.5.x before 0.2.5.11"
}
]
}
}
]
},
"vendor_name": "The Tor Project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html",
"refsource": "MISC",
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/15083",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/15083"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-2688",
"datePublished": "2020-01-24T17:46:21",
"dateReserved": "2015-03-24T00:00:00",
"dateUpdated": "2024-08-06T05:24:38.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0380 (GCVE-0-2017-0380)
Vulnerability from cvelistv5
Published
2017-09-18 16:00
Modified
2024-08-05 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- use of uninitialized stack data
Summary
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Tor before 0.3.1.7 |
Version: Tor before 0.3.1.7 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:57.111Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/23490"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486"
},
{
"name": "1039519",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039519"
},
{
"name": "DSA-3993",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3993"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor before 0.3.1.7",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor before 0.3.1.7"
}
]
}
],
"datePublic": "2017-09-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "use of uninitialized stack data",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-05T10:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/23490"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486"
},
{
"name": "1039519",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039519"
},
{
"name": "DSA-3993",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3993"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0380",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor before 0.3.1.7",
"version": {
"version_data": [
{
"version_value": "Tor before 0.3.1.7"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "use of uninitialized stack data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/23490",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/23490"
},
{
"name": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486",
"refsource": "CONFIRM",
"url": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486"
},
{
"name": "1039519",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039519"
},
{
"name": "DSA-3993",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3993"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0380",
"datePublished": "2017-09-18T16:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:57.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-8516 (GCVE-0-2020-8516)
Vulnerability from cvelistv5
Published
2020-02-02 12:52
Modified
2024-08-04 10:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:03:45.879Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-8516"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33129"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-10T17:14:48",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-8516"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33129"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-8516",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html",
"refsource": "MISC",
"url": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html"
},
{
"name": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html",
"refsource": "MISC",
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html"
},
{
"name": "https://security-tracker.debian.org/tracker/CVE-2020-8516",
"refsource": "MISC",
"url": "https://security-tracker.debian.org/tracker/CVE-2020-8516"
},
{
"name": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html",
"refsource": "MISC",
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/33129",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/33129"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-8516",
"datePublished": "2020-02-02T12:52:56",
"dateReserved": "2020-02-02T00:00:00",
"dateUpdated": "2024-08-04T10:03:45.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-46702 (GCVE-0-2021-46702)
Vulnerability from cvelistv5
Published
2022-02-26 02:56
Modified
2024-08-04 05:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:17:42.618Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sciencedirect.com/science/article/pii/S0167404821001358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn\u0027t properly free memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-26T02:56:26",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sciencedirect.com/science/article/pii/S0167404821001358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-46702",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn\u0027t properly free memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sciencedirect.com/science/article/pii/S0167404821001358",
"refsource": "MISC",
"url": "https://www.sciencedirect.com/science/article/pii/S0167404821001358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-46702",
"datePublished": "2022-02-26T02:56:26",
"dateReserved": "2022-02-26T00:00:00",
"dateUpdated": "2024-08-04T05:17:42.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0376 (GCVE-0-2017-0376)
Vulnerability from cvelistv5
Published
2017-06-09 17:00
Modified
2024-08-05 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- reachable assertion
Summary
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Tor before 0.3.0.8 |
Version: Tor before 0.3.0.8 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:57.029Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"name": "DSA-3877",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3877"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor before 0.3.0.8",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor before 0.3.0.8"
}
]
}
],
"datePublic": "2017-06-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "reachable assertion",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"name": "DSA-3877",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3877"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0376",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor before 0.3.0.8",
"version": {
"version_data": [
{
"version_value": "Tor before 0.3.0.8"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "reachable assertion"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html",
"refsource": "CONFIRM",
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"name": "DSA-3877",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3877"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/22494",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
},
{
"name": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd",
"refsource": "CONFIRM",
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0376",
"datePublished": "2017-06-09T17:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:57.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34549 (GCVE-0-2021-34549)
Vulnerability from cvelistv5
Published
2021-06-29 11:08
Modified
2024-08-04 00:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:12:50.424Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-10T04:06:20",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-34549",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391"
},
{
"name": "https://blog.torproject.org/node/2041",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-25"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-34549",
"datePublished": "2021-06-29T11:08:22",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-08-04T00:12:50.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38385 (GCVE-0-2021-38385)
Vulnerability from cvelistv5
Published
2021-08-30 00:00
Modified
2024-08-04 01:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:37:16.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://blog.torproject.org"
},
{
"tags": [
"x_transferred"
],
"url": "https://blog.torproject.org/node/2062"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40078"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-03T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://blog.torproject.org"
},
{
"url": "https://blog.torproject.org/node/2062"
},
{
"url": "https://bugs.torproject.org/tpo/core/tor/40078"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-38385",
"datePublished": "2021-08-30T00:00:00",
"dateReserved": "2021-08-10T00:00:00",
"dateUpdated": "2024-08-04T01:37:16.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-2689 (GCVE-0-2015-2689)
Vulnerability from cvelistv5
Published
2020-01-24 17:46
Modified
2024-08-06 05:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Other
Summary
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tor Project | Tor |
Version: before 0.2.4.26 Version: 0.2.5.x before 0.2.5.11 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:37.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/14129"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "The Tor Project",
"versions": [
{
"status": "affected",
"version": "before 0.2.4.26"
},
{
"status": "affected",
"version": "0.2.5.x before 0.2.5.11"
}
]
}
],
"datePublic": "2015-03-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-24T17:46:17",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/14129"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-2689",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "before 0.2.4.26"
},
{
"version_value": "0.2.5.x before 0.2.5.11"
}
]
}
}
]
},
"vendor_name": "The Tor Project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html",
"refsource": "MISC",
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/14129",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/14129"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-2689",
"datePublished": "2020-01-24T17:46:17",
"dateReserved": "2015-03-24T00:00:00",
"dateUpdated": "2024-08-06T05:24:37.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34548 (GCVE-0-2021-34548)
Vulnerability from cvelistv5
Published
2021-06-29 11:00
Modified
2024-08-04 00:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:12:50.422Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-15T15:06:13",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-34548",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389"
},
{
"name": "https://blog.torproject.org/node/2041",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/node/2041"
},
{
"name": "GLSA-202107-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"name": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-34548",
"datePublished": "2021-06-29T11:00:16",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-08-04T00:12:50.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2250 (GCVE-0-2012-2250)
Vulnerability from cvelistv5
Published
2014-02-03 02:00
Modified
2024-08-06 19:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:26:09.024Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-10-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-03T02:57:00",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2012-2250",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitweb.torproject.org/tor.git?a=blob_plain;hb=HEAD;f=ChangeLog",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain;hb=HEAD;f=ChangeLog"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2012-2250",
"datePublished": "2014-02-03T02:00:00",
"dateReserved": "2012-04-16T00:00:00",
"dateUpdated": "2024-08-06T19:26:09.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8955 (GCVE-0-2019-8955)
Vulnerability from cvelistv5
Published
2019-02-21 23:00
Modified
2024-08-04 21:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:31:37.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "107136",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/107136"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/29168"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312"
},
{
"name": "openSUSE-SU-2019:1107",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-02T17:06:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "107136",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/107136"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/29168"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312"
},
{
"name": "openSUSE-SU-2019:1107",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-8955",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "107136",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/107136"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/29168",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/29168"
},
{
"name": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312",
"refsource": "MISC",
"url": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312"
},
{
"name": "openSUSE-SU-2019:1107",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-8955",
"datePublished": "2019-02-21T23:00:00",
"dateReserved": "2019-02-20T00:00:00",
"dateUpdated": "2024-08-04T21:31:37.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-1254 (GCVE-0-2016-1254)
Vulnerability from cvelistv5
Published
2017-12-05 16:00
Modified
2024-08-05 22:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.662Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:3281",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html"
},
{
"name": "FEDORA-2016-95b4e9077e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/blog/tor-02812-released"
},
{
"name": "openSUSE-SU-2016:3282",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html"
},
{
"name": "DSA-3741",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2016/dsa-3741"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/21018"
},
{
"name": "FEDORA-2016-76b646637e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-12-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-05T15:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "openSUSE-SU-2016:3281",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html"
},
{
"name": "FEDORA-2016-95b4e9077e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/blog/tor-02812-released"
},
{
"name": "openSUSE-SU-2016:3282",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html"
},
{
"name": "DSA-3741",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2016/dsa-3741"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/21018"
},
{
"name": "FEDORA-2016-76b646637e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2016-1254",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:3281",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html"
},
{
"name": "FEDORA-2016-95b4e9077e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/"
},
{
"name": "https://blog.torproject.org/blog/tor-02812-released",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/blog/tor-02812-released"
},
{
"name": "openSUSE-SU-2016:3282",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html"
},
{
"name": "DSA-3741",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2016/dsa-3741"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/21018",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/21018"
},
{
"name": "FEDORA-2016-76b646637e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/"
},
{
"name": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2016-1254",
"datePublished": "2017-12-05T16:00:00",
"dateReserved": "2015-12-27T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-2928 (GCVE-0-2015-2928)
Vulnerability from cvelistv5
Published
2020-01-24 17:22
Modified
2024-08-06 05:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Other
Summary
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tor Project | Tor |
Version: before 0.2.4.27 Version: 0.2.5.x before 0.2.5.12 Version: 0.2.6.x before 0.2.6.7 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:32:20.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15600"
},
{
"name": "[oss-security] 20150406 CVE Request: tor: new upstream releases (0.2.6.7, 0.2.5.12 and 0.2.4.27) fixing security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "The Tor Project",
"versions": [
{
"status": "affected",
"version": "before 0.2.4.27"
},
{
"status": "affected",
"version": "0.2.5.x before 0.2.5.12"
},
{
"status": "affected",
"version": "0.2.6.x before 0.2.6.7"
}
]
}
],
"datePublic": "2015-04-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-24T17:22:15",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15600"
},
{
"name": "[oss-security] 20150406 CVE Request: tor: new upstream releases (0.2.6.7, 0.2.5.12 and 0.2.4.27) fixing security issues",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2015-2928",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "before 0.2.4.27"
},
{
"version_value": "0.2.5.x before 0.2.5.12"
},
{
"version_value": "0.2.6.x before 0.2.6.7"
}
]
}
}
]
},
"vendor_name": "The Tor Project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/15600",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/15600"
},
{
"name": "[oss-security] 20150406 CVE Request: tor: new upstream releases (0.2.6.7, 0.2.5.12 and 0.2.4.27) fixing security issues",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2015-2928",
"datePublished": "2020-01-24T17:22:15",
"dateReserved": "2015-04-06T00:00:00",
"dateUpdated": "2024-08-06T05:32:20.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2249 (GCVE-0-2012-2249)
Vulnerability from cvelistv5
Published
2014-02-03 02:00
Modified
2024-08-06 19:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:26:08.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-10-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-03T02:57:00",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2012-2249",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitweb.torproject.org/tor.git?a=blob_plain;hb=HEAD;f=ChangeLog",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain;hb=HEAD;f=ChangeLog"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2012-2249",
"datePublished": "2014-02-03T02:00:00",
"dateReserved": "2012-04-16T00:00:00",
"dateUpdated": "2024-08-06T19:26:08.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7295 (GCVE-0-2013-7295)
Vulnerability from cvelistv5
Published
2014-01-17 19:00
Modified
2024-08-06 18:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.348Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:0143",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html"
},
{
"name": "[tor-talk] 20131223 Tor 0.2.4.20 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-07T23:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:0143",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html"
},
{
"name": "[tor-talk] 20131223 Tor 0.2.4.20 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:0143",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html"
},
{
"name": "[tor-talk] 20131223 Tor 0.2.4.20 is released",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7295",
"datePublished": "2014-01-17T19:00:00",
"dateReserved": "2014-01-17T00:00:00",
"dateUpdated": "2024-08-06T18:01:20.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-4419 (GCVE-0-2012-4419)
Vulnerability from cvelistv5
Published
2012-09-14 18:00
Modified
2024-08-06 20:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:35:09.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6690"
},
{
"name": "[oss-security] 20120912 Re: CVE id request: tor",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2012/09/13/2"
},
{
"name": "50583",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50583"
},
{
"name": "[tor-talk] 20120905 Tor 0.2.3.21-rc is out",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"name": "FEDORA-2012-14638",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5"
},
{
"name": "openSUSE-SU-2012:1278",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-09-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-11-06T10:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6690"
},
{
"name": "[oss-security] 20120912 Re: CVE id request: tor",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2012/09/13/2"
},
{
"name": "50583",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50583"
},
{
"name": "[tor-talk] 20120905 Tor 0.2.3.21-rc is out",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"name": "FEDORA-2012-14638",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5"
},
{
"name": "openSUSE-SU-2012:1278",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-4419",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201301-03",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/6690",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/6690"
},
{
"name": "[oss-security] 20120912 Re: CVE id request: tor",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2012/09/13/2"
},
{
"name": "50583",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50583"
},
{
"name": "[tor-talk] 20120905 Tor 0.2.3.21-rc is out",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html"
},
{
"name": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"name": "FEDORA-2012-14638",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"name": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5"
},
{
"name": "openSUSE-SU-2012:1278",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-4419",
"datePublished": "2012-09-14T18:00:00",
"dateReserved": "2012-08-21T00:00:00",
"dateUpdated": "2024-08-06T20:35:09.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5573 (GCVE-0-2012-5573)
Vulnerability from cvelistv5
Published
2013-01-01 11:00
Modified
2024-08-06 21:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:14:16.375Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6252"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=444804"
},
{
"name": "51329",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51329"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16"
},
{
"name": "[oss-security] 20121126 Re: tor DoS via SENDME cells",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2012/11/26/11"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes"
},
{
"name": "tor-sendme-dos(80289)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80289"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-11-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6252"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.gentoo.org/show_bug.cgi?id=444804"
},
{
"name": "51329",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51329"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16"
},
{
"name": "[oss-security] 20121126 Re: tor DoS via SENDME cells",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2012/11/26/11"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes"
},
{
"name": "tor-sendme-dos(80289)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80289"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880310"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-5573",
"datePublished": "2013-01-01T11:00:00",
"dateReserved": "2012-10-24T00:00:00",
"dateUpdated": "2024-08-06T21:14:16.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-5117 (GCVE-0-2014-5117)
Vulnerability from cvelistv5
Published
2014-07-30 16:00
Modified
2024-08-06 11:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:34:37.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "60084",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60084"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/1038"
},
{
"name": "60647",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60647"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack"
},
{
"name": "[tor-talk] 20140730 Tor 0.2.5.6-alpha is out",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html"
},
{
"name": "[tor-announce] 20140730 Tor security advisory: \"relay early\" traffic confirmation attack",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html"
},
{
"name": "[tor-announce] 20140730 Tor 0.2.4.23 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-04T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "60084",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60084"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/1038"
},
{
"name": "60647",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60647"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack"
},
{
"name": "[tor-talk] 20140730 Tor 0.2.5.6-alpha is out",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html"
},
{
"name": "[tor-announce] 20140730 Tor security advisory: \"relay early\" traffic confirmation attack",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html"
},
{
"name": "[tor-announce] 20140730 Tor 0.2.4.23 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5117",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "60084",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60084"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/1038",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/1038"
},
{
"name": "60647",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60647"
},
{
"name": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack"
},
{
"name": "[tor-talk] 20140730 Tor 0.2.5.6-alpha is out",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html"
},
{
"name": "[tor-announce] 20140730 Tor security advisory: \"relay early\" traffic confirmation attack",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html"
},
{
"name": "[tor-announce] 20140730 Tor 0.2.4.23 is released",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5117",
"datePublished": "2014-07-30T16:00:00",
"dateReserved": "2014-07-30T00:00:00",
"dateUpdated": "2024-08-06T11:34:37.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-4922 (GCVE-0-2012-4922)
Vulnerability from cvelistv5
Published
2012-09-14 18:00
Modified
2024-08-06 20:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:50:18.010Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6811"
},
{
"name": "[oss-security] 20120912 CVE id request: tor",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2012/09/12/5"
},
{
"name": "FEDORA-2012-14638",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404"
},
{
"name": "[tor-talk] 20120912 Tor 0.2.3.22-rc is out",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html"
},
{
"name": "openSUSE-SU-2012:1278",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-09-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-11-06T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201301-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6811"
},
{
"name": "[oss-security] 20120912 CVE id request: tor",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2012/09/12/5"
},
{
"name": "FEDORA-2012-14638",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404"
},
{
"name": "[tor-talk] 20120912 Tor 0.2.3.22-rc is out",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html"
},
{
"name": "openSUSE-SU-2012:1278",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4922",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201301-03",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"name": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/6811",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/6811"
},
{
"name": "[oss-security] 20120912 CVE id request: tor",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2012/09/12/5"
},
{
"name": "FEDORA-2012-14638",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"name": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404",
"refsource": "CONFIRM",
"url": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404"
},
{
"name": "[tor-talk] 20120912 Tor 0.2.3.22-rc is out",
"refsource": "MLIST",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html"
},
{
"name": "openSUSE-SU-2012:1278",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4922",
"datePublished": "2012-09-14T18:00:00",
"dateReserved": "2012-09-14T00:00:00",
"dateUpdated": "2024-08-06T20:50:18.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-15572 (GCVE-0-2020-15572)
Vulnerability from cvelistv5
Published
2020-07-15 16:02
Modified
2024-08-04 13:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:22:29.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/wiki/TROVE"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-15T16:02:10",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/wiki/TROVE"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-15572",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119"
},
{
"name": "https://trac.torproject.org/projects/tor/wiki/TROVE",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/wiki/TROVE"
},
{
"name": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-15572",
"datePublished": "2020-07-15T16:02:10",
"dateReserved": "2020-07-06T00:00:00",
"dateUpdated": "2024-08-04T13:22:29.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-0377 (GCVE-0-2017-0377)
Vulnerability from cvelistv5
Published
2017-07-02 15:00
Modified
2024-08-05 13:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- privacy bypass
Summary
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:03:56.989Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22753"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security-tracker.debian.org/CVE-2017-0377"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor"
}
]
}
],
"datePublic": "2017-07-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "privacy bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-02T14:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22753"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security-tracker.debian.org/CVE-2017-0377"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2017-0377",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "Tor"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "privacy bypass"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/22753",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/22753"
},
{
"name": "https://security-tracker.debian.org/CVE-2017-0377",
"refsource": "CONFIRM",
"url": "https://security-tracker.debian.org/CVE-2017-0377"
},
{
"name": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
},
{
"name": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
},
{
"name": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"refsource": "CONFIRM",
"url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2017-0377",
"datePublished": "2017-07-02T15:00:00",
"dateReserved": "2016-11-29T00:00:00",
"dateUpdated": "2024-08-05T13:03:56.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28089 (GCVE-0-2021-28089)
Vulnerability from cvelistv5
Published
2021-03-19 04:18
Modified
2024-08-03 21:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:33:17.404Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"name": "FEDORA-2021-e68317166d",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-10T04:06:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"name": "FEDORA-2021-e68317166d",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-28089",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304",
"refsource": "MISC",
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304"
},
{
"name": "https://blog.torproject.org/node/2009",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/node/2009"
},
{
"name": "FEDORA-2021-e68317166d",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"name": "GLSA-202107-25",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202107-25"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-28089",
"datePublished": "2021-03-19T04:18:41",
"dateReserved": "2021-03-08T00:00:00",
"dateUpdated": "2024-08-03T21:33:17.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23589 (GCVE-0-2023-23589)
Vulnerability from cvelistv5
Published
2023-01-14 00:00
Modified
2025-04-07 18:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:35:33.384Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40730"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc"
},
{
"name": "DSA-5320",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5320"
},
{
"name": "FEDORA-2023-c290171664",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/"
},
{
"name": "FEDORA-2023-1254a1fc28",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/"
},
{
"name": "[debian-lts-announce] 20230128 [SECURITY] [DLA 3286-1] tor security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-23589",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-07T18:13:18.347462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T18:14:11.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-03T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes"
},
{
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40730"
},
{
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc"
},
{
"name": "DSA-5320",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5320"
},
{
"name": "FEDORA-2023-c290171664",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/"
},
{
"name": "FEDORA-2023-1254a1fc28",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/"
},
{
"name": "[debian-lts-announce] 20230128 [SECURITY] [DLA 3286-1] tor security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html"
},
{
"name": "GLSA-202305-11",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202305-11"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-23589",
"datePublished": "2023-01-14T00:00:00.000Z",
"dateReserved": "2023-01-14T00:00:00.000Z",
"dateUpdated": "2025-04-07T18:14:11.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-16541 (GCVE-0-2017-16541)
Vulnerability from cvelistv5
Published
2017-11-04 18:00
Modified
2024-08-05 20:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:27:04.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24052"
},
{
"name": "GLSA-201810-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201810-01"
},
{
"name": "RHSA-2018:2693",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2693"
},
{
"name": "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/"
},
{
"name": "GLSA-201811-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/"
},
{
"name": "DSA-4327",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4327"
},
{
"name": "RHSA-2018:3403",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3403"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.torproject.org/tor-browser-709-released"
},
{
"name": "1041610",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041610"
},
{
"name": "101665",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101665"
},
{
"name": "RHSA-2018:2692",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2692"
},
{
"name": "RHSA-2018:3458",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3458"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-25T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24052"
},
{
"name": "GLSA-201810-01",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201810-01"
},
{
"name": "RHSA-2018:2693",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2693"
},
{
"name": "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/"
},
{
"name": "GLSA-201811-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/"
},
{
"name": "DSA-4327",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4327"
},
{
"name": "RHSA-2018:3403",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3403"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.torproject.org/tor-browser-709-released"
},
{
"name": "1041610",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041610"
},
{
"name": "101665",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101665"
},
{
"name": "RHSA-2018:2692",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2692"
},
{
"name": "RHSA-2018:3458",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3458"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16541",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/24052",
"refsource": "MISC",
"url": "https://trac.torproject.org/projects/tor/ticket/24052"
},
{
"name": "GLSA-201810-01",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201810-01"
},
{
"name": "RHSA-2018:2693",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2693"
},
{
"name": "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html"
},
{
"name": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/",
"refsource": "MISC",
"url": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/"
},
{
"name": "GLSA-201811-13",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"name": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/",
"refsource": "MISC",
"url": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/"
},
{
"name": "DSA-4327",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4327"
},
{
"name": "RHSA-2018:3403",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3403"
},
{
"name": "https://blog.torproject.org/tor-browser-709-released",
"refsource": "MISC",
"url": "https://blog.torproject.org/tor-browser-709-released"
},
{
"name": "1041610",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041610"
},
{
"name": "101665",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101665"
},
{
"name": "RHSA-2018:2692",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:2692"
},
{
"name": "RHSA-2018:3458",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2018:3458"
},
{
"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081",
"refsource": "MISC",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16541",
"datePublished": "2017-11-04T18:00:00",
"dateReserved": "2017-11-04T00:00:00",
"dateUpdated": "2024-08-05T20:27:04.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-0491 (GCVE-0-2018-0491)
Vulnerability from cvelistv5
Published
2018-03-05 15:00
Modified
2024-08-05 03:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- use-after-free
Summary
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:28:10.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24700"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25117"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"name": "44994",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44994/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tor",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Tor"
}
]
}
],
"datePublic": "2018-03-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "use-after-free",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-11T09:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24700"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25117"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"name": "44994",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44994/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2018-0491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tor",
"version": {
"version_data": [
{
"version_value": "Tor"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "use-after-free"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://trac.torproject.org/projects/tor/ticket/24700",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/24700"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/25117",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/25117"
},
{
"name": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"name": "44994",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44994/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2018-0491",
"datePublished": "2018-03-05T15:00:00",
"dateReserved": "2017-11-27T00:00:00",
"dateUpdated": "2024-08-05T03:28:10.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-8860 (GCVE-0-2016-8860)
Vulnerability from cvelistv5
Published
2017-01-04 20:00
Modified
2024-08-06 02:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:35:01.107Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
},
{
"name": "GLSA-201612-45",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201612-45"
},
{
"name": "[oss-security] 20161019 Re: CVE request for tor",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2016/10/19/11"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://trac.torproject.org/projects/tor/ticket/20384"
},
{
"name": "95116",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95116"
},
{
"name": "DSA-3694",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3694"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-10-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
},
{
"name": "GLSA-201612-45",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201612-45"
},
{
"name": "[oss-security] 20161019 Re: CVE request for tor",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2016/10/19/11"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://trac.torproject.org/projects/tor/ticket/20384"
},
{
"name": "95116",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95116"
},
{
"name": "DSA-3694",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3694"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-8860",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://blog.torproject.org/blog/tor-0289-released-important-fixes",
"refsource": "CONFIRM",
"url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes"
},
{
"name": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce",
"refsource": "CONFIRM",
"url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
},
{
"name": "GLSA-201612-45",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201612-45"
},
{
"name": "[oss-security] 20161019 Re: CVE request for tor",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2016/10/19/11"
},
{
"name": "https://trac.torproject.org/projects/tor/ticket/20384",
"refsource": "CONFIRM",
"url": "https://trac.torproject.org/projects/tor/ticket/20384"
},
{
"name": "95116",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95116"
},
{
"name": "DSA-3694",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3694"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-8860",
"datePublished": "2017-01-04T20:00:00",
"dateReserved": "2016-10-19T00:00:00",
"dateUpdated": "2024-08-06T02:35:01.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2013-01-01 12:35
Modified
2025-04-11 00:51
Severity ?
Summary
The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://openwall.com/lists/oss-security/2012/11/26/11 | ||
| secalert@redhat.com | http://secunia.com/advisories/51329 | ||
| secalert@redhat.com | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| secalert@redhat.com | https://bugs.gentoo.org/show_bug.cgi?id=444804 | ||
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=880310 | ||
| secalert@redhat.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/80289 | ||
| secalert@redhat.com | https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16 | Patch | |
| secalert@redhat.com | https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes | ||
| secalert@redhat.com | https://trac.torproject.org/projects/tor/ticket/6252 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2012/11/26/11 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/51329 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.gentoo.org/show_bug.cgi?id=444804 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=880310 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/80289 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/6252 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.2.38 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 | |
| torproject | tor | 0.2.3.21 | |
| torproject | tor | 0.2.3.22 | |
| torproject | tor | 0.2.3.23 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:rc:*:*:*:*:*:*",
"matchCriteriaId": "ACD84AC0-8E46-423B-A126-44C0035F478B",
"versionEndIncluding": "0.2.3.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.38:*:*:*:*:*:*:*",
"matchCriteriaId": "70EB1D7F-0E37-43B4-86CB-3E3D91056974",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.21:rc:*:*:*:*:*:*",
"matchCriteriaId": "5F4A9816-F5D0-42DA-9ADB-F0D2B4A08A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.22:rc:*:*:*:*:*:*",
"matchCriteriaId": "6B44CB99-1F06-4042-A8AA-AB520DE38511",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.23:rc:*:*:*:*:*:*",
"matchCriteriaId": "DBEFA4D9-67B6-474C-B92D-0BB970FE78C2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command."
},
{
"lang": "es",
"value": "La funci\u00f3n connection_edge_process_relay_cell en o/relay.c en Tor antes de v0.2.3.25 mantiene circuitos incluso si llega una c\u00e9lula SendMe llega, lo que podr\u00eda permitir a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de memoria o la velocidad excesiva de c\u00e9lulas recepci\u00f3n) o evitar las restricciones de control de flujo a trav\u00e9s de un comando RELAY_COMMAND_SENDME."
}
],
"id": "CVE-2012-5573",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-01-01T12:35:14.617",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2012/11/26/11"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/51329"
},
{
"source": "secalert@redhat.com",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=444804"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880310"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80289"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16"
},
{
"source": "secalert@redhat.com",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6252"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2012/11/26/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/51329"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=444804"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80289"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/6252"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-12-05 16:29
Modified
2025-04-20 01:37
Severity ?
Summary
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html | Third Party Advisory | |
| security@debian.org | http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html | Third Party Advisory | |
| security@debian.org | https://blog.torproject.org/blog/tor-02812-released | Vendor Advisory | |
| security@debian.org | https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd | Patch, Vendor Advisory | |
| security@debian.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/ | ||
| security@debian.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/ | ||
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/21018 | Issue Tracking, Vendor Advisory | |
| security@debian.org | https://www.debian.org/security/2016/dsa-3741 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/blog/tor-02812-released | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/21018 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2016/dsa-3741 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| fedoraproject | fedora | 24 | |
| fedoraproject | fedora | 25 | |
| opensuse | leap | 42.2 | |
| opensuse | opensuse | 13.2 | |
| opensuse_project | leap | 42.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0A6D36-385D-48AC-AF4C-589DEFC30CFF",
"versionEndExcluding": "0.2.8.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*",
"matchCriteriaId": "C729D5D1-ED95-443A-9F53-5D7C2FD9B80C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*",
"matchCriteriaId": "772E9557-A371-4664-AE2D-4135AAEB89AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse_project:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF605E46-ADCE-45B3-BBBA-E593D3CEE2A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor."
},
{
"lang": "es",
"value": "Tor, en versiones anteriores a la 0.2.8.12 podr\u00eda permitir que los atacantes remotos provoquen una denegaci\u00f3n de servicio (cierre inesperado del cliente) mediante un descriptor de servicio oculto manipulado."
}
],
"id": "CVE-2016-1254",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-12-05T16:29:00.313",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-02812-released"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd"
},
{
"source": "security@debian.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/"
},
{
"source": "security@debian.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/21018"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2016/dsa-3741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00154.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-12/msg00155.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-02812-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXOJSMCTIOHLBRYFBVEL3CDLGPZXX6WE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTU2R253477RZLYAJAR5DAXAON7KIVLA/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/21018"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2016/dsa-3741"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-04 20:59
Modified
2025-04-12 10:46
Severity ?
Summary
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://openwall.com/lists/oss-security/2016/10/19/11 | Third Party Advisory | |
| cve@mitre.org | http://www.debian.org/security/2016/dsa-3694 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/95116 | ||
| cve@mitre.org | https://blog.torproject.org/blog/tor-0289-released-important-fixes | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce | Patch, Vendor Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201612-45 | ||
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/20384 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2016/10/19/11 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2016/dsa-3694 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95116 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/blog/tor-0289-released-important-fixes | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201612-45 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/20384 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.2.9.0 | |
| torproject | tor | 0.2.9.1 | |
| torproject | tor | 0.2.9.2 | |
| torproject | tor | 0.2.9.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C4F2166D-0611-4AEC-B112-3E5A10D7A0AB",
"versionEndIncluding": "0.2.8.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F1E7EAA3-1FF5-4234-AD50-C83A3C8655C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F58A98FD-7A39-4718-9264-76AFB431BE32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "3DF92477-A17F-43AF-A351-E12B28AFFB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "4D0B925E-C788-4F47-A757-9E7C0962C744",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data."
},
{
"lang": "es",
"value": "Tor en versiones anteriores a 0.2.8.9 y 0.2.9.x en versiones anteriores a 0.2.9.4-alpha ten\u00eda funciones internas autorizadas a esperar que buf_t data ten\u00eda terminaci\u00f3n NUL, pero la implementaci\u00f3n de or/buffers.c no asegur\u00f3 que la terminaci\u00f3n NUL estuviera presente, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (cliente, servicio oculto, transmisi\u00f3n, o ca\u00edda de autoridad) a trav\u00e9s de datos manipulados."
}
],
"id": "CVE-2016-8860",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-04T20:59:00.340",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2016/10/19/11"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3694"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95116"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201612-45"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/20384"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2016/10/19/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3694"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95116"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0289-released-important-fixes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/torproject/tor/commit/3cea86eb2fbb65949673eb4ba8ebb695c87a57ce"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201612-45"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/20384"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-02-02 13:15
Modified
2024-11-21 05:38
Severity ?
Summary
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html | Mailing List, Vendor Advisory | |
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html | Mailing List, Vendor Advisory | |
| cve@mitre.org | https://security-tracker.debian.org/tracker/CVE-2020-8516 | Third Party Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/33129 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html | Exploit, Mitigation, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html | Mailing List, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html | Mailing List, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2020-8516 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/33129 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html | Exploit, Mitigation, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A433651E-DAE8-44B3-AB2F-069776068357",
"versionEndIncluding": "0.4.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DE290F9-C6B7-4D2C-B7E5-CAB1E9D3A7E6",
"versionEndIncluding": "0.4.2.6",
"versionStartIncluding": "0.4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability"
},
{
"lang": "es",
"value": "** EN DISPUTA ** El demonio en Tor hasta la versi\u00f3n 0.4.1.8 y versiones 0.4.2.x hasta la versi\u00f3n 0.4.2.6, no comprueba que un nodo rendezvous sea conocido antes de intentar conectarse a \u00e9l, lo que podr\u00eda facilitar a atacantes remotos descubrir informaci\u00f3n del circuito. NOTA: El equipo de red de Tor afirma que este es un comportamiento previsto y no una vulnerabilidad."
}
],
"id": "CVE-2020-8516",
"lastModified": "2024-11-21T05:38:58.863",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-02-02T13:15:10.903",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-8516"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33129"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014146.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-dev/2020-February/014147.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2020-8516"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mitigation",
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-29 12:15
Modified
2024-11-21 06:10
Severity ?
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 | Broken Link | |
| cve@mitre.org | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2666B22-DC07-4BFA-A756-3DC4E970EBDD",
"versionEndExcluding": "0.3.5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "072B35B0-7EBF-4652-BB89-12B4BEC9A8EF",
"versionEndExcluding": "0.4.4.9",
"versionStartIncluding": "0.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57ED9234-622B-4B0D-8E29-2851A87DE0D1",
"versionEndExcluding": "0.4.5.9",
"versionStartIncluding": "0.4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFD89230-DBEF-4134-9C42-8187CE542B7C",
"versionEndExcluding": "0.4.6.5",
"versionStartIncluding": "0.4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor"
},
{
"lang": "es",
"value": "Se ha detectado un problema en Tor versiones anteriores a 0.4.6.5, tambi\u00e9n se conoce como TROVE-2021-006. El an\u00e1lisis del descriptor del servicio de v3 onion, permite un acceso a la memoria fuera de l\u00edmites, y un bloqueo del cliente, por medio de un descriptor de servicio onion dise\u00f1ado"
}
],
"id": "CVE-2021-34550",
"lastModified": "2024-11-21T06:10:39.317",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-29T12:15:08.670",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40392"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-02-26 03:15
Modified
2024-11-21 06:34
Severity ?
Summary
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.sciencedirect.com/science/article/pii/S0167404821001358 | Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.sciencedirect.com/science/article/pii/S0167404821001358 | Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | 9.0.7 | |
| microsoft | windows | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:9.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "8B3535EA-B5BF-48E9-BBC1-F0FAEB438C7E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn\u0027t properly free memory."
},
{
"lang": "es",
"value": "Tor Browser versi\u00f3n 9.0.7 en Windows 10 build 10586, es vulnerable a una divulgaci\u00f3n de informaci\u00f3n. Esto podr\u00eda permitir a atacantes locales omitir la funci\u00f3n de anonimato prevista y obtener informaci\u00f3n sobre los servicios onion visitados por un usuario local. Esto puede lograrse al analizar memoria RAM incluso varias horas despu\u00e9s de que el usuario local haya usado el producto. Esto ocurre porque el producto no libera apropiadamente la memoria.\n"
}
],
"id": "CVE-2021-46702",
"lastModified": "2024-11-21T06:34:35.990",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-26T03:15:07.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.sciencedirect.com/science/article/pii/S0167404821001358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Technical Description",
"Third Party Advisory"
],
"url": "https://www.sciencedirect.com/science/article/pii/S0167404821001358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-404"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-24 18:15
Modified
2024-11-21 02:27
Severity ?
Summary
Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html | Mailing List, Vendor Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/14129 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html | Mailing List, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/14129 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55010D56-46F9-4EA3-BD8B-8C29380DEC2F",
"versionEndExcluding": "0.2.4.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "969C5514-4DB6-4AF4-899C-3AF13C248B80",
"versionEndExcluding": "0.2.5.11",
"versionStartIncluding": "0.2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.2.4.26 y versiones 0.2.5.x anteriores a 0.2.5.11, no maneja apropiadamente los estados de resoluci\u00f3n de conexi\u00f3n pendiente durante los per\u00edodos de alta carga DNS, lo que permite a atacantes remotos causar una denegaci\u00f3n de servicio (falla de aserci\u00f3n y salida del demonio) por medio de paquetes."
}
],
"id": "CVE-2015-2689",
"lastModified": "2024-11-21T02:27:51.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-24T18:15:12.317",
"references": [
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/14129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/14129"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-05 15:29
Modified
2024-11-21 03:38
Severity ?
Summary
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 | Vendor Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/24700 | Issue Tracking, Mitigation, Vendor Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/25117 | Issue Tracking, Patch, Vendor Advisory | |
| security@debian.org | https://www.exploit-db.com/exploits/44994/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/24700 | Issue Tracking, Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/25117 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/44994/ | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E3C7B44-DBC7-4D14-94F9-0DC25C1167EE",
"versionEndExcluding": "0.3.2.10",
"versionStartIncluding": "0.3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list."
},
{
"lang": "es",
"value": "Se ha descubierto un problema de uso de memoria previamente liberada en Tor, en versiones 0.3.2.x anteriores a la 0.3.2.10. Permite que atacantes remotos provoquen una denegaci\u00f3n de servicio (cierre inesperado del relevo) debido a que la implementaci\u00f3n KIST permite que un canal se a\u00f1ada m\u00e1s de una vez en la lista de pendientes."
}
],
"id": "CVE-2018-0491",
"lastModified": "2024-11-21T03:38:20.637",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-05T15:29:00.270",
"references": [
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Mitigation",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24700"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25117"
},
{
"source": "security@debian.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44994/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Mitigation",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24700"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25117"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44994/"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-24 18:15
Modified
2024-11-21 02:28
Severity ?
Summary
The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://openwall.com/lists/oss-security/2015/04/06/5 | Mailing List, Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/15600 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2015/04/06/5 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/15600 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1426FCC4-48C3-45C8-BD87-165842ECE26E",
"versionEndExcluding": "0.2.4.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4971E1A7-6C29-4B8F-9966-3086F3248DDF",
"versionEndExcluding": "0.2.5.12",
"versionStartIncluding": "0.2.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "452818A6-484D-4620-BECD-B7C55170371A",
"versionEndExcluding": "0.2.6.7",
"versionStartIncluding": "0.2.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors."
},
{
"lang": "es",
"value": "La implementaci\u00f3n del servidor Hidden Service (HS) en Tor versiones anteriores a 0.2.4.27, versiones 0.2.5.x anteriores a 0.2.5.12 y versiones 0.2.6.x anteriores a 0.2.6.7, permite a atacantes remotos causar una denegaci\u00f3n de servicio (falla de aserci\u00f3n y salida del demonio ) por medio de vectores no especificados."
}
],
"id": "CVE-2015-2928",
"lastModified": "2024-11-21T02:28:20.097",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-24T18:15:12.367",
"references": [
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15600"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15600"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-23 13:15
Modified
2024-11-21 04:55
Severity ?
Summary
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/202003-50 | Third Party Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/33120 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202003-50 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/33120 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| opensuse | backports | sle-15 | |
| opensuse | leap | 15.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A0F32196-820B-417F-A8BA-C2F1EAC01717",
"versionEndExcluding": "0.3.5.10",
"versionStartIncluding": "0.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8DEF7C0-0B37-4339-8B96-63A5B817AA7C",
"versionEndExcluding": "0.4.1.9",
"versionStartExcluding": "0.4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "990A6710-D662-4B46-8B1D-963F682CB234",
"versionEndIncluding": "0.4.2.7",
"versionStartExcluding": "0.4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:backports:sle-15:sp1:*:*:*:*:*:*",
"matchCriteriaId": "C84D9410-31B7-421A-AD99-8ED2E45A9BC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.3.5.10, versiones 0.4.x anteriores a 0.4.1.9 y versiones 0.4.2.x anteriores a 0.4.2.7, permite a atacantes remotos causar una Denegaci\u00f3n de Servicio (consumo de CPU), tambi\u00e9n se conoce como TROVE-2020-002."
}
],
"id": "CVE-2020-10592",
"lastModified": "2024-11-21T04:55:39.500",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-23T13:15:12.957",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33120"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33120"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-05 15:29
Modified
2024-11-21 03:38
Severity ?
Summary
An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 | Vendor Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/25074 | Vendor Advisory | |
| security@debian.org | https://www.debian.org/security/2018/dsa-4183 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/25074 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2018/dsa-4183 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | 0.3.1.1 | |
| torproject | tor | 0.3.1.2 | |
| torproject | tor | 0.3.1.3 | |
| torproject | tor | 0.3.1.4 | |
| torproject | tor | 0.3.1.5 | |
| torproject | tor | 0.3.1.6 | |
| torproject | tor | 0.3.2.1 | |
| torproject | tor | 0.3.2.2 | |
| torproject | tor | 0.3.2.3 | |
| torproject | tor | 0.3.2.4 | |
| torproject | tor | 0.3.2.5 | |
| torproject | tor | 0.3.2.6 | |
| torproject | tor | 0.3.2.7 | |
| torproject | tor | 0.3.2.8 | |
| torproject | tor | 0.3.2.9 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB5264E-06CF-490E-AF89-6B69EC87E0E6",
"versionEndIncluding": "0.2.9.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D374CB99-AD88-4894-BAC3-365CB784BDC5",
"versionEndIncluding": "0.3.1.9",
"versionStartIncluding": "0.3.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "725179F8-E402-4238-9A17-AD237145C0D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B3B36195-8CE2-40CC-9701-5ECA042A395F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "47279FE4-FD6E-4FE6-B2BD-7D3EA20A2F11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "801F7D20-5525-4733-A0EB-E54D68C6B2D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "65B2EE3E-A8AB-46C0-8A43-E89ECC6F9E12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.6:rc:*:*:*:*:*:*",
"matchCriteriaId": "11081D34-ACC7-4C62-A02A-41B1A22727B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8726B8B1-2DA1-4A14-8786-694FDC76EB13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2920D83F-194D-46FC-8424-8FA170E7B1A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8C882A1F-B1E1-4512-99EF-356C1B888E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "269D4F0F-1A64-4BD7-8ECA-D6AEB82238FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B221269E-646C-4539-813A-3704328D58E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.6:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5702AFE4-DDC4-4992-B258-5D279035219F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.7:rc:*:*:*:*:*:*",
"matchCriteriaId": "A361C8B4-37E0-4A93-9235-6D0545C0A778",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.8:rc:*:*:*:*:*:*",
"matchCriteriaId": "D897A116-0868-404D-A395-FECFE8EAFA8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B702FB76-CAAD-4F27-B500-482FEA31154E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en Tor en versiones anteriores a la 0.2.9.15, versiones 0.3.1.x anteriores a la 0.3.1.10 y versiones 0.3.2.x anteriores a la 0.3.2.10. La implementaci\u00f3n del subprotocolo directory-authority protocol-list permite que atacantes remotos provoquen una denegaci\u00f3n de servicio (desreferencia de puntero NULL y cierre inesperado de directory-authority) mediante un descriptor de relevo con formato err\u00f3neo que se gestiona de manera incorrecta durante la votaci\u00f3n."
}
],
"id": "CVE-2018-0490",
"lastModified": "2024-11-21T03:38:20.493",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-05T15:29:00.207",
"references": [
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25074"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4183"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/25074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4183"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-15 17:15
Modified
2024-11-21 05:05
Severity ?
Summary
Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/33119 | Vendor Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/wiki/TROVE | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/33119 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/wiki/TROVE | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | 0.4.4.0 | |
| torproject | tor | 0.4.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0DAC8510-95BF-4FF8-9975-86AA5A0417C5",
"versionEndExcluding": "0.3.5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95D2A6D5-E281-4514-A4BC-74736E93BECD",
"versionEndExcluding": "0.4.2.8",
"versionStartExcluding": "0.4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04AC62C8-A529-439A-8D7D-C79EA9658F76",
"versionEndExcluding": "0.4.3.6",
"versionStartExcluding": "0.4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "C3708B4D-8F02-47B4-81E8-AA626B04C906",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2143F2C0-BBD4-4B14-84D6-70125DD37376",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.4.3.6, presenta un acceso de la memoria fuera de l\u00edmites que permite un ataque de denegaci\u00f3n de servicio remoto (bloqueo) contra instancias de Tor creadas para usar Mozilla Network Security Services (NSS), tambi\u00e9n se conoce como TROVE-2020-001"
}
],
"id": "CVE-2020-15572",
"lastModified": "2024-11-21T05:05:46.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-15T17:15:11.283",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/wiki/TROVE"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/33119"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/wiki/TROVE"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-30 16:55
Modified
2025-04-12 10:46
Severity ?
Summary
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://secunia.com/advisories/60084 | ||
| cve@mitre.org | http://secunia.com/advisories/60647 | ||
| cve@mitre.org | https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack | ||
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html | ||
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html | Vendor Advisory | |
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html | ||
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/1038 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/60084 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/60647 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/1038 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.2.38 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 | |
| torproject | tor | 0.2.3.21 | |
| torproject | tor | 0.2.3.22 | |
| torproject | tor | 0.2.3.23 | |
| torproject | tor | 0.2.3.24 | |
| torproject | tor | 0.2.4.1 | |
| torproject | tor | 0.2.4.2 | |
| torproject | tor | 0.2.4.3 | |
| torproject | tor | 0.2.4.4 | |
| torproject | tor | 0.2.4.5 | |
| torproject | tor | 0.2.4.6 | |
| torproject | tor | 0.2.4.7 | |
| torproject | tor | 0.2.4.8 | |
| torproject | tor | 0.2.4.9 | |
| torproject | tor | 0.2.4.10 | |
| torproject | tor | 0.2.4.11 | |
| torproject | tor | 0.2.4.12 | |
| torproject | tor | 0.2.4.13 | |
| torproject | tor | 0.2.4.14 | |
| torproject | tor | 0.2.4.15 | |
| torproject | tor | 0.2.4.16 | |
| torproject | tor | 0.2.4.17 | |
| torproject | tor | 0.2.4.18 | |
| torproject | tor | 0.2.4.19 | |
| torproject | tor | 0.2.4.20 | |
| torproject | tor | 0.2.5.2 | |
| torproject | tor | 0.2.5.3 | |
| torproject | tor | 0.2.5.4 | |
| torproject | tor | 0.2.5.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:alpha:*:*:*:*:*:*",
"matchCriteriaId": "935A56A2-DF93-488D-8096-230A01E446B7",
"versionEndIncluding": "0.2.4.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.38:*:*:*:*:*:*:*",
"matchCriteriaId": "70EB1D7F-0E37-43B4-86CB-3E3D91056974",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.21:rc:*:*:*:*:*:*",
"matchCriteriaId": "5F4A9816-F5D0-42DA-9ADB-F0D2B4A08A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.22:rc:*:*:*:*:*:*",
"matchCriteriaId": "6B44CB99-1F06-4042-A8AA-AB520DE38511",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.23:rc:*:*:*:*:*:*",
"matchCriteriaId": "DBEFA4D9-67B6-474C-B92D-0BB970FE78C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.24:rc:*:*:*:*:*:*",
"matchCriteriaId": "52BAD857-DA86-4BB0-88AA-63C611E87BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "0CDF07FC-69FD-439D-807F-01B70803C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "A8433119-07E6-47BD-B8E6-4E0BBB694811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B5EAA2B8-1923-4BB3-A685-E7B6275E9FD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2A03FBE6-EC3D-4D24-9447-B75CE67F2737",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "40221BB3-73E6-4E7D-8994-BFCC8C8C0EDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.6:alpha:*:*:*:*:*:*",
"matchCriteriaId": "3A1BFADB-776C-4522-9747-2BB094A5091F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.7:alpha:*:*:*:*:*:*",
"matchCriteriaId": "CCE1D379-5374-4158-8310-96F2CA67ED61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.8:alpha:*:*:*:*:*:*",
"matchCriteriaId": "160AC840-E501-4DE4-AF63-E5F987219F6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.9:alpha:*:*:*:*:*:*",
"matchCriteriaId": "CA548CBD-31C5-4261-91A5-0D1314B827F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.10:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D3421BEF-A468-4947-8EA7-02BF500D511C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.11:alpha:*:*:*:*:*:*",
"matchCriteriaId": "15D0BE3B-F4A4-4E18-9D83-487AFB366BBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.12:alpha:*:*:*:*:*:*",
"matchCriteriaId": "A3DDD7F0-D041-40FF-919A-2C905A7E2238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "088D58DE-5C4D-4E0C-8CF4-3A2109D3F4A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "082F51D5-5890-45A9-8EDA-0E0215C0EAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.15:rc:*:*:*:*:*:*",
"matchCriteriaId": "72C8D3FA-8B99-4A4D-BC62-FD50EF77CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.16:rc:*:*:*:*:*:*",
"matchCriteriaId": "FDFF7FEE-4B36-4B86-8BC2-64C9009B3D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.17:rc:*:*:*:*:*:*",
"matchCriteriaId": "D5A18B95-0EEB-403C-A9C1-E559DBC64E2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "FCFFA8A6-6D1A-4CFF-95A8-5FF2BE6287C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.19:*:*:*:*:*:*:*",
"matchCriteriaId": "0836F444-5C80-436F-BD3C-ECBB53A24DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.20:*:*:*:*:*:*:*",
"matchCriteriaId": "8B67CD90-35C0-412A-A1F9-B159697E9B7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.5.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "86E9B839-B753-41A3-A127-17CC928A6B9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.5.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B6BCD4D1-7B94-44E3-B87F-F7BD0F636745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.5.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2E71D935-2A57-440D-A3A3-E91A2C0D4104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.5.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "9BCA77D5-38BE-4161-AC32-4099C54F2252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names."
},
{
"lang": "es",
"value": "Tor anterior a 0.2.4.23 y 0.2.5 anterior a 0.2.5.6-alpha mantiene un circuito despu\u00e9s de que un cliente reciba una c\u00e9lula RELAY_EARLY entrante, lo que facilita a atacantes remotos realizar ataques de confirmaci\u00f3n de trafico mediante el uso de la pauta de c\u00e9lulas RELAY y RELAY_EARLY como la manera de comunicar informaci\u00f3n a cerca de nombres escondidos de servicios."
}
],
"id": "CVE-2014-5117",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-07-30T16:55:07.073",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60084"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60647"
},
{
"source": "cve@mitre.org",
"url": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack"
},
{
"source": "cve@mitre.org",
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html"
},
{
"source": "cve@mitre.org",
"url": "https://trac.torproject.org/projects/tor/ticket/1038"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60084"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60647"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000093.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.torproject.org/pipermail/tor-talk/2014-July/034180.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://trac.torproject.org/projects/tor/ticket/1038"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-09-14 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html | ||
| cve@mitre.org | http://openwall.com/lists/oss-security/2012/09/12/5 | ||
| cve@mitre.org | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| cve@mitre.org | https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes | ||
| cve@mitre.org | https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404 | ||
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html | ||
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/6811 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2012/09/12/5 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/6811 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 | |
| torproject | tor | 0.2.3.21 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BA32083F-0241-4C1C-8CCB-E7EC3B1337B5",
"versionEndIncluding": "0.2.2.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.21:rc:*:*:*:*:*:*",
"matchCriteriaId": "5F4A9816-F5D0-42DA-9ADB-F0D2B4A08A74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419."
},
{
"lang": "es",
"value": "La funci\u00f3n tor_timegm en com\u00fan/util.c en Tor v0.2.2.39 antes, y antes de v0.2.3.x v0.2.3.22-rc, no valida correctamente los valores de tiempo, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (error de aserci\u00f3n y salida del demonio) a trav\u00e9s de una lista de objetos con formato incorrecto. Se trata de una vulnerabilidad diferente a CVE-2012-4419a.\r\n"
}
],
"id": "CVE-2012-4922",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-09-14T18:55:04.980",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
},
{
"source": "cve@mitre.org",
"url": "http://openwall.com/lists/oss-security/2012/09/12/5"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "cve@mitre.org",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"source": "cve@mitre.org",
"url": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404"
},
{
"source": "cve@mitre.org",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html"
},
{
"source": "cve@mitre.org",
"url": "https://trac.torproject.org/projects/tor/ticket/6811"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2012/09/12/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git/commit/973c18bf0e84d14d8006a9ae97fde7f7fb97e404"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://trac.torproject.org/projects/tor/ticket/6811"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-07-17 23:15
Modified
2024-11-21 07:08
Severity ?
Summary
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html | Mailing List, Patch, Vendor Advisory | |
| cve@mitre.org | https://security-tracker.debian.org/tracker/CVE-2022-33903 | Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/202305-11 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html | Mailing List, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2022-33903 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202305-11 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A38EEEED-6F12-4B23-807C-85A7A47A845F",
"versionEndExcluding": "0.4.7.8",
"versionStartIncluding": "0.4.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation."
},
{
"lang": "es",
"value": "Tor versiones 0.4.7.x anteriores a 0.4.7.8, permite una denegaci\u00f3n de servicio por medio de la estimaci\u00f3n del RTT"
}
],
"id": "CVE-2022-33903",
"lastModified": "2024-11-21T07:08:34.123",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-07-17T23:15:09.103",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2022-33903"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202305-11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2022-June/000242.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2022-33903"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202305-11"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-29 11:15
Modified
2024-11-21 06:10
Severity ?
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40389 | Broken Link | |
| cve@mitre.org | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40389 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2666B22-DC07-4BFA-A756-3DC4E970EBDD",
"versionEndExcluding": "0.3.5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "072B35B0-7EBF-4652-BB89-12B4BEC9A8EF",
"versionEndExcluding": "0.4.4.9",
"versionStartIncluding": "0.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57ED9234-622B-4B0D-8E29-2851A87DE0D1",
"versionEndExcluding": "0.4.5.9",
"versionStartIncluding": "0.4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFD89230-DBEF-4134-9C42-8187CE542B7C",
"versionEndExcluding": "0.4.6.5",
"versionStartIncluding": "0.4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream."
},
{
"lang": "es",
"value": "Se ha detectado un problema en Tor versiones anteriores a 0.4.6.5, tambi\u00e9n se conoce como TROVE-2021-003. Un atacante puede falsificar las funciones RELAY_END o RELAY_RESOLVED para omitir el control de acceso previsto para terminar un flujo"
}
],
"id": "CVE-2021-34548",
"lastModified": "2024-11-21T06:10:38.977",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-29T11:15:07.883",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/163510/Tor-Half-Closed-Connection-Stream-Confusion.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-290"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-02-21 23:29
Modified
2024-11-21 04:50
Severity ?
Summary
In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/107136 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312 | Vendor Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/29168 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/107136 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/29168 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | 0.3.4.0 | |
| torproject | tor | 0.3.4.1 | |
| torproject | tor | 0.3.4.2 | |
| torproject | tor | 0.3.4.3 | |
| torproject | tor | 0.3.4.4 | |
| torproject | tor | 0.3.4.5 | |
| torproject | tor | 0.3.4.6 | |
| torproject | tor | 0.3.4.7 | |
| torproject | tor | 0.3.5.0 | |
| torproject | tor | 0.3.5.1 | |
| torproject | tor | 0.3.5.2 | |
| torproject | tor | 0.3.5.3 | |
| torproject | tor | 0.3.5.4 | |
| torproject | tor | 0.3.5.5 | |
| torproject | tor | 0.3.5.6 | |
| torproject | tor | 0.3.5.7 | |
| torproject | tor | 0.4.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A10DAB4-B269-4BBD-BDF8-51951D0287AB",
"versionEndExcluding": "0.3.3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89E540D4-1A1C-49D7-994B-9A71C857574E",
"versionEndExcluding": "0.3.4.11",
"versionStartIncluding": "0.3.4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.0:alpha-dev:*:*:*:*:*:*",
"matchCriteriaId": "429FF676-3237-49FF-ACFE-3E6269E1C4E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D55E6E76-F0AE-4E55-B372-078C109BAE15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "BC3D781B-74E0-4F79-BDE1-764EBAEC4FBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8B8CCE05-7824-4CD7-8081-560318ADAAE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.4:rc:*:*:*:*:*:*",
"matchCriteriaId": "E436D382-5226-4E08-AAC6-148FA60DECCA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "D004733F-0FF3-42A1-9676-63AF3B049FA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.6:rc:*:*:*:*:*:*",
"matchCriteriaId": "E8DCE61B-725D-4EE3-9BA9-882C1C834509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.4.7:rc:*:*:*:*:*:*",
"matchCriteriaId": "A57C5658-9DB4-451B-8E32-8C231DBDDC8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.0:alpha-dev:*:*:*:*:*:*",
"matchCriteriaId": "225A250D-509B-4ED6-9484-9024FC50D6AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F90B4BE3-B970-425C-8BD2-B48B41EB3160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "69CD80C2-7D70-45C9-A4E3-9693E6866D4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "4CC09533-7154-43CF-9E84-AD17055A2978",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "4D5B0AF1-8B8E-43C0-BD5C-C4FE423403DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "00638F43-2148-460A-B647-232170476A14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.6:rc:*:*:*:*:*:*",
"matchCriteriaId": "A46571F6-5611-4D62-BE0D-CF11B788D63C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BF5F8142-F62D-479D-9BE8-1444572879D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "3ED7A3E0-F720-476F-B440-4724BC8AAD9F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler."
},
{
"lang": "es",
"value": "En Tor, en versiones anteriores a la 0.3.3.12, en las 0.3.4.x anteriores a la 0.3.4.11, en las 0.3.5.x anteriores a la 0.3.5.8 y en las 0.4.x anteriores a la 0.4.0.2-alpha, puede ocurrir una denegaci\u00f3n de servicio (DoS) remota contra los clientes Tor, adem\u00e1s de reproducciones mediante el agotamiento de memoria en el programador \"KIST cell\"."
}
],
"id": "CVE-2019-8955",
"lastModified": "2024-11-21T04:50:44.113",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-02-21T23:29:00.267",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107136"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/29168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/107136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/29168"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-09-18 16:29
Modified
2025-04-20 01:37
Severity ?
Summary
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://www.debian.org/security/2017/dsa-3993 | ||
| security@debian.org | http://www.securitytracker.com/id/1039519 | ||
| security@debian.org | https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486 | Patch, Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/23490 | Mitigation, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3993 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1039519 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/23490 | Mitigation, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.2.9.0 | |
| torproject | tor | 0.2.9.0 | |
| torproject | tor | 0.2.9.1 | |
| torproject | tor | 0.2.9.2 | |
| torproject | tor | 0.2.9.3 | |
| torproject | tor | 0.2.9.4 | |
| torproject | tor | 0.2.9.5 | |
| torproject | tor | 0.2.9.6 | |
| torproject | tor | 0.2.9.8 | |
| torproject | tor | 0.2.9.9 | |
| torproject | tor | 0.2.9.10 | |
| torproject | tor | 0.2.9.11 | |
| torproject | tor | 0.3.0.0 | |
| torproject | tor | 0.3.0.1 | |
| torproject | tor | 0.3.0.2 | |
| torproject | tor | 0.3.0.3 | |
| torproject | tor | 0.3.0.4 | |
| torproject | tor | 0.3.0.5 | |
| torproject | tor | 0.3.0.6 | |
| torproject | tor | 0.3.0.7 | |
| torproject | tor | 0.3.0.8 | |
| torproject | tor | 0.3.0.9 | |
| torproject | tor | 0.3.0.10 | |
| torproject | tor | 0.3.1.1 | |
| torproject | tor | 0.3.1.2 | |
| torproject | tor | 0.3.1.3 | |
| torproject | tor | 0.3.1.4 | |
| torproject | tor | 0.3.1.5 | |
| torproject | tor | 0.3.1.6 | |
| torproject | tor | 0.3.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1656D224-8858-4C8D-9E4A-439AEFB5B83D",
"versionEndIncluding": "0.2.8.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A377C0D2-0081-4C2D-90D6-C6A4A689AF5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F1E7EAA3-1FF5-4234-AD50-C83A3C8655C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "F58A98FD-7A39-4718-9264-76AFB431BE32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "3DF92477-A17F-43AF-A351-E12B28AFFB7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "4D0B925E-C788-4F47-A757-9E7C0962C744",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "24F88DB6-38FF-4667-8664-E719D8AB9114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "9FB692AE-737A-4EE1-9F3B-8A412343B207",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A3484577-F652-4FE7-96B3-200D4224CE31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7993C7DE-32E6-412A-87B2-EC4EBF20B045",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CDAE75A5-EB2D-49CE-B6A8-24A86361DD8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6DF18C5D-1EFB-4755-B5BF-C500E84F19EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.9.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9AEDB54E-57CC-4BA5-933C-927649E16045",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F55CC07A-4639-4B72-9F65-D27043CFFF28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "C7722805-17F9-4215-81B9-E30EE016778B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "028D39E2-0968-4B98-A9E4-60B51440175F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8FB26D60-528A-4E06-84A9-8B86143307DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.4:rc:*:*:*:*:*:*",
"matchCriteriaId": "56134ADE-05F9-4087-BAD3-09480DBA2CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.5:rc:*:*:*:*:*:*",
"matchCriteriaId": "AB6431AD-B020-4277-8633-27ED05F4D770",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0B815A38-5CE8-4BF3-AE6F-C11CACDBFA75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6364CA-DBDA-4626-90A9-FF06A0E08619",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA71B4E-8EF4-41D4-AE30-F643D2916209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8E09522C-61F3-495F-A82F-47251468736E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "7EBA8DAD-EF04-4252-8FCA-5E21FB506D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "725179F8-E402-4238-9A17-AD237145C0D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B3B36195-8CE2-40CC-9701-5ECA042A395F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "47279FE4-FD6E-4FE6-B2BD-7D3EA20A2F11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "801F7D20-5525-4733-A0EB-E54D68C6B2D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "65B2EE3E-A8AB-46C0-8A43-E89ECC6F9E12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.1.6:alpha:*:*:*:*:*:*",
"matchCriteriaId": "05E91522-EA34-4894-898F-BA5E2051975B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "49250EAD-6CC3-4CB3-9407-C520635B3C77",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit."
},
{
"lang": "es",
"value": "La funci\u00f3n rend_service_intro_established en or/rendservice.c en versiones de Tor anteriores a la 0.2.8.15, versiones 0.2.9.x anteriores a la 0.2.9.12, versiones 0.3.0.x anteriores a la 0.3.0.11, versiones 0.3.1.x anteriores a la 0.3.1.7 y versiones 0.3.2.x anteriores a la 0.3.2.1-alpha, cuando se deshabilita SafeLogging, permite a los atacantes obtener informaci\u00f3n sensible mediante el acceso al archivo de registro de un servicio oculto. Esto se debe a que los datos de la pila sin inicializar se incluyen en un mensaje de error sobre el punto de entrada a la red."
}
],
"id": "CVE-2017-0380",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-09-18T16:29:00.207",
"references": [
{
"source": "security@debian.org",
"url": "http://www.debian.org/security/2017/dsa-3993"
},
{
"source": "security@debian.org",
"url": "http://www.securitytracker.com/id/1039519"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486"
},
{
"source": "security@debian.org",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/23490"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2017/dsa-3993"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1039519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/23490"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-06-11 21:29
Modified
2025-03-21 19:24
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@mozilla.org | http://rhn.redhat.com/errata/RHSA-2016-2843.html | Third Party Advisory | |
| security@mozilla.org | http://rhn.redhat.com/errata/RHSA-2016-2850.html | Third Party Advisory | |
| security@mozilla.org | http://www.securityfocus.com/bid/94591 | Third Party Advisory, VDB Entry | |
| security@mozilla.org | http://www.securitytracker.com/id/1037370 | Third Party Advisory, VDB Entry | |
| security@mozilla.org | https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 | Exploit, Issue Tracking, Vendor Advisory | |
| security@mozilla.org | https://security.gentoo.org/glsa/201701-15 | Third Party Advisory | |
| security@mozilla.org | https://security.gentoo.org/glsa/201701-35 | Third Party Advisory | |
| security@mozilla.org | https://www.debian.org/security/2016/dsa-3730 | Third Party Advisory | |
| security@mozilla.org | https://www.exploit-db.com/exploits/41151/ | Exploit, Third Party Advisory, VDB Entry | |
| security@mozilla.org | https://www.exploit-db.com/exploits/42327/ | Exploit, Third Party Advisory, VDB Entry | |
| security@mozilla.org | https://www.mozilla.org/security/advisories/mfsa2016-92/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2016-2843.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2016-2850.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94591 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1037370 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-15 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-35 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2016/dsa-3730 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/41151/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/42327/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mozilla.org/security/advisories/mfsa2016-92/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| debian | debian_linux | 9.0 | |
| redhat | enterprise_linux | 5.0 | |
| redhat | enterprise_linux | 6.0 | |
| redhat | enterprise_linux | 7.0 | |
| redhat | enterprise_linux_desktop | 5.0 | |
| redhat | enterprise_linux_desktop | 6.0 | |
| redhat | enterprise_linux_desktop | 7.0 | |
| redhat | enterprise_linux_server | 5.0 | |
| redhat | enterprise_linux_server | 6.0 | |
| redhat | enterprise_linux_server | 7.0 | |
| redhat | enterprise_linux_server_aus | 7.3 | |
| redhat | enterprise_linux_server_aus | 7.4 | |
| redhat | enterprise_linux_server_eus | 7.3 | |
| redhat | enterprise_linux_server_eus | 7.4 | |
| redhat | enterprise_linux_server_eus | 7.5 | |
| redhat | enterprise_linux_workstation | 5.0 | |
| redhat | enterprise_linux_workstation | 6.0 | |
| redhat | enterprise_linux_workstation | 7.0 | |
| mozilla | thunderbird | * | |
| microsoft | windows | - | |
| mozilla | firefox | * | |
| microsoft | windows | - | |
| mozilla | firefox | * | |
| microsoft | windows | - | |
| torproject | tor | - | |
| microsoft | windows | - |
{
"cisaActionDue": "2023-07-13",
"cisaExploitAdd": "2023-06-22",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "133AAFA7-AF42-4D7B-8822-AA2E85611BF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "54D669D4-6D7E-449D-80C1-28FA44F06FFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "98381E61-F082-4302-B51F-5648884F998B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D99A687E-EAE6-417E-A88E-D0082BC194CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A8442C20-41F9-47FD-9A12-E724D3A31FD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D0AC5CD5-6E58-433C-9EB3-6DFE5656463E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C981E74-6ACC-4FA0-A831-041533742304",
"versionEndExcluding": "45.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F500D7C2-53C4-4626-8B8B-628D65A1ED6C",
"versionEndExcluding": "50.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
"matchCriteriaId": "3588FF4A-AF7B-4D59-984E-231679AB6E4B",
"versionEndExcluding": "45.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14724D6F-AC53-48DD-A676-012300727CDC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox \u003c 50.0.2, Firefox ESR \u003c 45.5.1, and Thunderbird \u003c 45.5.1."
},
{
"lang": "es",
"value": "Se ha descubierto una vulnerabilidad de uso de memoria previamente liberada en SVG Animation. Se ha descubierto un exploit construido sobre esta vulnerabilidad \"in the wild\" que apunta a usuarios de Firefox y Tor Browser en Windows. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50.0.2, Firefox ESR en versiones anteriores a la 45.5.1 y Thunderbird en versiones anteriores a la 45.5.1."
}
],
"id": "CVE-2016-9079",
"lastModified": "2025-03-21T19:24:52.383",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2018-06-11T21:29:01.797",
"references": [
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94591"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1037370"
},
{
"source": "security@mozilla.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201701-35"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2016/dsa-3730"
},
{
"source": "security@mozilla.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41151/"
},
{
"source": "security@mozilla.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42327/"
},
{
"source": "security@mozilla.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2016-92/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2843.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2850.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94591"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1037370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201701-35"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2016/dsa-3730"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41151/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42327/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2016-92/"
}
],
"sourceIdentifier": "security@mozilla.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-09 17:29
Modified
2025-04-20 01:37
Severity ?
Summary
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://www.securityfocus.com/bid/99017 | Third Party Advisory, VDB Entry | |
| security@debian.org | https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7 | Issue Tracking, Patch, Vendor Advisory | |
| security@debian.org | https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html | Mailing List, Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/22493 | Issue Tracking | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99017 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/22493 | Issue Tracking |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2CEE4949-FE1A-4AA7-8CA2-895EE9A0723F",
"versionEndExcluding": "0.3.0.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell."
},
{
"lang": "es",
"value": "La funci\u00f3n de servicio oculto en Tor antes de la versi\u00f3n 0.3.0.8 permite una denegaci\u00f3n de servicio (fallo de aserci\u00f3n y salida de demonio) en la funci\u00f3n relay_send_end_cell_from_edge_ a trav\u00e9s de una llamada BEGIN con formato incorrecto."
}
],
"id": "CVE-2017-0375",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-09T17:29:00.217",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99017"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7"
},
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22493"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-02 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | https://blog.torproject.org/blog/tor-0309-released-security-update-clients | Release Notes, Vendor Advisory | |
| security@debian.org | https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients | Release Notes, Vendor Advisory | |
| security@debian.org | https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350 | Patch, Third Party Advisory | |
| security@debian.org | https://security-tracker.debian.org/CVE-2017-0377 | Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/22753 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/blog/tor-0309-released-security-update-clients | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/CVE-2017-0377 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/22753 | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | 0.3.0.1 | |
| torproject | tor | 0.3.0.2 | |
| torproject | tor | 0.3.0.3 | |
| torproject | tor | 0.3.0.4 | |
| torproject | tor | 0.3.0.5 | |
| torproject | tor | 0.3.0.6 | |
| torproject | tor | 0.3.0.7 | |
| torproject | tor | 0.3.0.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "C7722805-17F9-4215-81B9-E30EE016778B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "028D39E2-0968-4B98-A9E4-60B51440175F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "8FB26D60-528A-4E06-84A9-8B86143307DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D60F7D93-611B-43F8-A3EE-874A34F912A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1B332C5B-1762-48BA-BD3E-7DD2CC01F65C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0B815A38-5CE8-4BF3-AE6F-C11CACDBFA75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6364CA-DBDA-4626-90A9-FF06A0E08619",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA71B4E-8EF4-41D4-AE30-F643D2916209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families."
},
{
"lang": "es",
"value": "Las versiones 0.3.x de Tor anteriores a la 0.3.0.9 cuentan con un algoritmo de selecci\u00f3n de restricciones que solo considera el exit relay (no la familia del exit relay), lo que podr\u00eda permitir que atacantes remotos superen las propiedades de anonimato planeadas aprovechando la existencia de grandes familias."
}
],
"id": "CVE-2017-0377",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-02T15:29:00.187",
"references": [
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
},
{
"source": "security@debian.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
},
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/CVE-2017-0377"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22753"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/CVE-2017-0377"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22753"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-29 12:15
Modified
2024-11-21 06:10
Severity ?
Summary
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 | Broken Link | |
| cve@mitre.org | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2041 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2666B22-DC07-4BFA-A756-3DC4E970EBDD",
"versionEndExcluding": "0.3.5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "072B35B0-7EBF-4652-BB89-12B4BEC9A8EF",
"versionEndExcluding": "0.4.4.9",
"versionStartIncluding": "0.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57ED9234-622B-4B0D-8E29-2851A87DE0D1",
"versionEndExcluding": "0.4.5.9",
"versionStartIncluding": "0.4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFD89230-DBEF-4134-9C42-8187CE542B7C",
"versionEndExcluding": "0.4.6.5",
"versionStartIncluding": "0.4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency."
},
{
"lang": "es",
"value": "Se ha detectado un problema en Tor versiones anteriores a 0.4.6.5, tambi\u00e9n se conoce como TROVE-2021-005. Un hashing es manejado inapropiadamente para determinadas recuperaciones de datos del circuito. Consecuentemente, un atacante puede desencadenar un ID de circuito elegido por el atacante para causar ineficiencia en el algoritmo"
}
],
"id": "CVE-2021-34549",
"lastModified": "2024-11-21T06:10:39.140",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-29T12:15:08.643",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-17 21:55
Modified
2025-04-11 00:51
Severity ?
Summary
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html | ||
| cve@mitre.org | https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.2.4.1 | |
| torproject | tor | 0.2.4.2 | |
| torproject | tor | 0.2.4.3 | |
| torproject | tor | 0.2.4.4 | |
| torproject | tor | 0.2.4.5 | |
| torproject | tor | 0.2.4.6 | |
| torproject | tor | 0.2.4.7 | |
| torproject | tor | 0.2.4.8 | |
| torproject | tor | 0.2.4.9 | |
| torproject | tor | 0.2.4.10 | |
| torproject | tor | 0.2.4.11 | |
| torproject | tor | 0.2.4.12 | |
| torproject | tor | 0.2.4.13 | |
| torproject | tor | 0.2.4.14 | |
| torproject | tor | 0.2.4.15 | |
| torproject | tor | 0.2.4.16 | |
| torproject | tor | 0.2.4.17 | |
| torproject | tor | 0.2.4.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "38E5B597-6BA7-4360-BA84-C8B2DD61C0FE",
"versionEndIncluding": "0.2.4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "0CDF07FC-69FD-439D-807F-01B70803C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "A8433119-07E6-47BD-B8E6-4E0BBB694811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "B5EAA2B8-1923-4BB3-A685-E7B6275E9FD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.4:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2A03FBE6-EC3D-4D24-9447-B75CE67F2737",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.5:alpha:*:*:*:*:*:*",
"matchCriteriaId": "40221BB3-73E6-4E7D-8994-BFCC8C8C0EDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.6:alpha:*:*:*:*:*:*",
"matchCriteriaId": "3A1BFADB-776C-4522-9747-2BB094A5091F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.7:alpha:*:*:*:*:*:*",
"matchCriteriaId": "CCE1D379-5374-4158-8310-96F2CA67ED61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.8:alpha:*:*:*:*:*:*",
"matchCriteriaId": "160AC840-E501-4DE4-AF63-E5F987219F6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.9:alpha:*:*:*:*:*:*",
"matchCriteriaId": "CA548CBD-31C5-4261-91A5-0D1314B827F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.10:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D3421BEF-A468-4947-8EA7-02BF500D511C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.11:alpha:*:*:*:*:*:*",
"matchCriteriaId": "15D0BE3B-F4A4-4E18-9D83-487AFB366BBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.12:alpha:*:*:*:*:*:*",
"matchCriteriaId": "A3DDD7F0-D041-40FF-919A-2C905A7E2238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "088D58DE-5C4D-4E0C-8CF4-3A2109D3F4A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "082F51D5-5890-45A9-8EDA-0E0215C0EAEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.15:rc:*:*:*:*:*:*",
"matchCriteriaId": "72C8D3FA-8B99-4A4D-BC62-FD50EF77CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.16:rc:*:*:*:*:*:*",
"matchCriteriaId": "FDFF7FEE-4B36-4B86-8BC2-64C9009B3D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.17:rc:*:*:*:*:*:*",
"matchCriteriaId": "D5A18B95-0EEB-403C-A9C1-E559DBC64E2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.4.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "FCFFA8A6-6D1A-4CFF-95A8-5FF2BE6287C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors."
},
{
"lang": "es",
"value": "Tor anteriores a 0.2.4.20, cuando OpenSSL 1.x es utilizado en conjunci\u00f3n con cierto ajuste de HardwareAccel en las plataformas Intel Sandy Bridge e Ivy Bridge, no genera apropiadamente n\u00fameros aleatorios para (1) claves de identidad de relay y (2) claves de identidad de servicio oculto, lo cual podr\u00eda hacer m\u00e1s f\u00e1cil para los atacantes remotos sortear mecanismos de protecci\u00f3n criptogr\u00e1fica a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-7295",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-17T21:55:14.613",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00095.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-01-14 01:15
Modified
2025-04-07 19:15
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc | Patch, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 | Exploit, Issue Tracking, Patch, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/ | ||
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/ | ||
| cve@mitre.org | https://security.gentoo.org/glsa/202305-11 | ||
| cve@mitre.org | https://www.debian.org/security/2023/dsa-5320 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40730 | Exploit, Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202305-11 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2023/dsa-5320 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 | |
| fedoraproject | fedora | 36 | |
| fedoraproject | fedora | 37 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12B2A54B-3113-4BB0-82D6-27EC4D1F4043",
"versionEndExcluding": "0.4.7.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002."
},
{
"lang": "es",
"value": "La opci\u00f3n SafeSocks en Tor anterior a 0.4.7.13 tiene un error l\u00f3gico en el que se puede usar el protocolo SOCKS4 inseguro pero no el protocolo SOCKS4a seguro, tambi\u00e9n conocido como TROVE-2022-002."
}
],
"id": "CVE-2023-23589",
"lastModified": "2025-04-07T19:15:52.637",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-01-14T01:15:15.627",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40730"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202305-11"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40730"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00026.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYOLTP6HQO2HPXUYKOR7P5YYYN7CINQQ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMY4FWXYKP3MDXTZ3EJ7XJVGBCKBK2XL/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202305-11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5320"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-693"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-30 05:15
Modified
2024-11-21 06:16
Severity ?
Summary
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://blog.torproject.org/node/2062 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://bugs.torproject.org/tpo/core/tor/40078 | Exploit, Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/202305-11 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2062 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.torproject.org/tpo/core/tor/40078 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202305-11 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8C159792-8514-46D7-A94C-C8C6F5983E18",
"versionEndExcluding": "0.3.5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3450D899-26F1-481F-BA7F-DB46F4DC3413",
"versionEndExcluding": "0.4.5.10",
"versionStartIncluding": "0.4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3BF13590-870D-4633-83E3-FE03C73305B0",
"versionEndExcluding": "0.4.6.7",
"versionStartIncluding": "0.4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.3.5.16, 0.4.5.10, y 0.4.6.7, maneja inapropiadamente la relaci\u00f3n entre la verificaci\u00f3n de firma por lotes y la verificaci\u00f3n de firma \u00fanica, conllevando a un fallo de aserci\u00f3n remota, tambi\u00e9n se conoce como TROVE-2021-007."
}
],
"id": "CVE-2021-38385",
"lastModified": "2024-11-21T06:16:57.803",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-30T05:15:07.237",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2062"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40078"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202305-11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2062"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202305-11"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-03-19 05:15
Modified
2024-11-21 05:59
Severity ?
Summary
Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org/node/2009 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40304 | Vendor Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ | ||
| cve@mitre.org | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2009 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40304 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | 0.4.4.0 | |
| torproject | tor | 0.4.4.1 | |
| torproject | tor | 0.4.4.2 | |
| torproject | tor | 0.4.4.3 | |
| fedoraproject | fedora | 33 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43571CF8-3E89-4207-85A4-809927C4E8B1",
"versionEndExcluding": "0.3.5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "172491E9-1095-4908-8D59-F65C7639FDAF",
"versionEndExcluding": "0.4.4.8",
"versionStartIncluding": "0.4.4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A7449C9D-05ED-49E4-A3D9-674B44E032F9",
"versionEndExcluding": "0.4.5.7",
"versionStartIncluding": "0.4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "C3708B4D-8F02-47B4-81E8-AA626B04C906",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2143F2C0-BBD4-4B14-84D6-70125DD37376",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "85811EFA-8639-439D-BC97-52C70D5937E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "419573B8-18FB-4BEA-8C21-023BA05B3D8E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.4.5.7, permite a un participante remoto en el protocolo de directorio de Tor agotar los recursos de la CPU en un objetivo, tambi\u00e9n se conoce como TROVE-2021-001"
}
],
"id": "CVE-2021-28089",
"lastModified": "2024-11-21T05:59:04.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-03-19T05:15:12.807",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40304"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-09-14 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html | ||
| secalert@redhat.com | http://openwall.com/lists/oss-security/2012/09/13/2 | ||
| secalert@redhat.com | http://secunia.com/advisories/50583 | ||
| secalert@redhat.com | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| secalert@redhat.com | https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes | ||
| secalert@redhat.com | https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 | ||
| secalert@redhat.com | https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html | ||
| secalert@redhat.com | https://trac.torproject.org/projects/tor/ticket/6690 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2012/09/13/2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/50583 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://security.gentoo.org/glsa/glsa-201301-03.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/6690 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BA32083F-0241-4C1C-8CCB-E7EC3B1337B5",
"versionEndIncluding": "0.2.2.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison."
},
{
"lang": "es",
"value": "La funci\u00f3n compare_tor_addr_to_addr_policy en or/policies.c en Tor antes de v0.2.2.39 y v0.2.3.x antes de v0.2.3.21-rc, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (error de aserci\u00f3n y salida del demonio) a trav\u00e9s de un valor cero en el campo port (puerto) que no se gestionado correctamente durante la comparaci\u00f3n de pol\u00edticas.\r\n"
}
],
"id": "CVE-2012-4419",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-09-14T18:55:04.917",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
},
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2012/09/13/2"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/50583"
},
{
"source": "secalert@redhat.com",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "secalert@redhat.com",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"source": "secalert@redhat.com",
"url": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5"
},
{
"source": "secalert@redhat.com",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html"
},
{
"source": "secalert@redhat.com",
"url": "https://trac.torproject.org/projects/tor/ticket/6690"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-10/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2012/09/13/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50583"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-201301-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git/commit/62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.torproject.org/pipermail/tor-talk/2012-September/025434.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://trac.torproject.org/projects/tor/ticket/6690"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-09 17:29
Modified
2025-04-20 01:37
Severity ?
Summary
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://www.debian.org/security/2017/dsa-3877 | Third Party Advisory | |
| security@debian.org | https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd | Issue Tracking, Patch, Third Party Advisory | |
| security@debian.org | https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html | Mailing List, Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/22494 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2017/dsa-3877 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/22494 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2CEE4949-FE1A-4AA7-8CA2-895EE9A0723F",
"versionEndExcluding": "0.3.0.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit."
},
{
"lang": "es",
"value": "La funci\u00f3n de servicio oculto en Tor antes de la versi\u00f3n 0.3.0.8 permite una denegaci\u00f3n de servicio (fallo de aserci\u00f3n y salida de demonio) en la funci\u00f3n connection_edge_process_relay_cell a trav\u00e9s de una c\u00e9lula BEGIN_DIR en un circuito de rendezvous"
}
],
"id": "CVE-2017-0376",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-09T17:29:00.263",
"references": [
{
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3877"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
},
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"source": "security@debian.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3877"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/22494"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-24 18:15
Modified
2024-11-21 02:27
Severity ?
Summary
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html | Mailing List, Vendor Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/15083 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html | Mailing List, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/15083 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55010D56-46F9-4EA3-BD8B-8C29380DEC2F",
"versionEndExcluding": "0.2.4.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "969C5514-4DB6-4AF4-899C-3AF13C248B80",
"versionEndExcluding": "0.2.5.11",
"versionStartIncluding": "0.2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets."
},
{
"lang": "es",
"value": "La funci\u00f3n buf_pullup en Tor versiones anteriores a 0.2.4.26 y versiones 0.2.5.x anteriores a 0.2.5.11, no maneja apropiadamente los tiempos de llegada inesperados de b\u00faferes con dise\u00f1os no v\u00e1lidos, lo que permite a atacantes remotos causar una denegaci\u00f3n de servicio (falla de aserci\u00f3n y salida del demonio) por medio de paquetes dise\u00f1ados."
}
],
"id": "CVE-2015-2688",
"lastModified": "2024-11-21T02:27:51.373",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-24T18:15:12.240",
"references": [
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15083"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15083"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-755"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-03 03:55
Modified
2025-04-11 00:51
Severity ?
Summary
Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.2.38 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 | |
| torproject | tor | 0.2.3.21 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:rc:*:*:*:*:*:*",
"matchCriteriaId": "E759A8A5-07EB-454B-AFA7-B4FB6B1B5B2C",
"versionEndIncluding": "0.2.3.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.38:*:*:*:*:*:*:*",
"matchCriteriaId": "70EB1D7F-0E37-43B4-86CB-3E3D91056974",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.21:rc:*:*:*:*:*:*",
"matchCriteriaId": "5F4A9816-F5D0-42DA-9ADB-F0D2B4A08A74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol."
},
{
"lang": "es",
"value": "Tor anterior a 0.2.3.23-rc permite a atacantes remotos causar una denegaci\u00f3n de servicio (fallo de aserci\u00f3n y cierre de demonio) a trav\u00e9s de un intento de renegociaci\u00f3n que se produce despu\u00e9s de la iniciaci\u00f3n del procolo de enlace V3."
}
],
"id": "CVE-2012-2249",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-02-03T03:55:03.627",
"references": [
{
"source": "security@debian.org",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-23 13:15
Modified
2024-11-21 04:55
Severity ?
Summary
Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/202003-50 | Third Party Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/33619 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202003-50 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/33619 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A0F32196-820B-417F-A8BA-C2F1EAC01717",
"versionEndExcluding": "0.3.5.10",
"versionStartIncluding": "0.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8DEF7C0-0B37-4339-8B96-63A5B817AA7C",
"versionEndExcluding": "0.4.1.9",
"versionStartExcluding": "0.4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "990A6710-D662-4B46-8B1D-963F682CB234",
"versionEndIncluding": "0.4.2.7",
"versionStartExcluding": "0.4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.3.5.10, versiones 0.4.x anteriores a 0.4.1.9 y versiones 0.4.2.x anteriores a 0.4.2.7, permite a atacantes remotos causar una Denegaci\u00f3n de servicio (p\u00e9rdida de memoria), tambi\u00e9n se conoce como TROVE-2020-004. Esto ocurre en la funci\u00f3n circpad_setup_machine_on_circ porque una m\u00e1quina de circuit-padding se puede negociar dos veces en el mismo circuito."
}
],
"id": "CVE-2020-10593",
"lastModified": "2024-11-21T04:55:39.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-23T13:15:13.033",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33619"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00052.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/33619"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-401"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-24 18:15
Modified
2024-11-21 02:28
Severity ?
Summary
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@debian.org | http://openwall.com/lists/oss-security/2015/04/06/5 | Mailing List, Third Party Advisory | |
| security@debian.org | https://trac.torproject.org/projects/tor/ticket/15601 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://openwall.com/lists/oss-security/2015/04/06/5 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/15601 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1426FCC4-48C3-45C8-BD87-165842ECE26E",
"versionEndExcluding": "0.2.4.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4971E1A7-6C29-4B8F-9966-3086F3248DDF",
"versionEndExcluding": "0.2.5.12",
"versionStartIncluding": "0.2.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "452818A6-484D-4620-BECD-B7C55170371A",
"versionEndExcluding": "0.2.6.7",
"versionStartIncluding": "0.2.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor."
},
{
"lang": "es",
"value": "La implementaci\u00f3n del cliente Hidden Service (HS) en Tor versiones anteriores a 0.2.4.27, versiones 0.2.5.x anteriores a 0.2.5.12 y versiones 0.2.6.x anteriores a 0.2.6.7, permite a los servidores remotos causar una denegaci\u00f3n de servicio (falla de aserci\u00f3n y salida de la aplicaci\u00f3n ) por medio de un descriptor HS malformado."
}
],
"id": "CVE-2015-2929",
"lastModified": "2024-11-21T02:28:20.207",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-24T18:15:12.443",
"references": [
{
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15601"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://openwall.com/lists/oss-security/2015/04/06/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/15601"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-03-19 05:15
Modified
2024-11-21 05:59
Severity ?
Summary
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://blog.torproject.org/node/2009 | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://bugs.torproject.org/tpo/core/tor/40316 | Vendor Advisory | |
| cve@mitre.org | https://gitlab.torproject.org/tpo/core/tor/-/issues/40316 | Vendor Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ | ||
| cve@mitre.org | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/node/2009 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.torproject.org/tpo/core/tor/40316 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gitlab.torproject.org/tpo/core/tor/-/issues/40316 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202107-25 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | * | |
| torproject | tor | 0.4.4.0 | |
| torproject | tor | 0.4.4.1 | |
| torproject | tor | 0.4.4.2 | |
| torproject | tor | 0.4.4.3 | |
| fedoraproject | fedora | 33 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43571CF8-3E89-4207-85A4-809927C4E8B1",
"versionEndExcluding": "0.3.5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "172491E9-1095-4908-8D59-F65C7639FDAF",
"versionEndExcluding": "0.4.4.8",
"versionStartIncluding": "0.4.4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A7449C9D-05ED-49E4-A3D9-674B44E032F9",
"versionEndExcluding": "0.4.5.7",
"versionStartIncluding": "0.4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "C3708B4D-8F02-47B4-81E8-AA626B04C906",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.1:alpha:*:*:*:*:*:*",
"matchCriteriaId": "2143F2C0-BBD4-4B14-84D6-70125DD37376",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.2:alpha:*:*:*:*:*:*",
"matchCriteriaId": "85811EFA-8639-439D-BC97-52C70D5937E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.4.4.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "419573B8-18FB-4BEA-8C21-023BA05B3D8E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002."
},
{
"lang": "es",
"value": "Tor versiones anteriores a 0.4.5.7, permite a un atacante remoto causar que autoridades del directorio de Tor salgan con un fallo de aserci\u00f3n, tambi\u00e9n se conoce como TROVE-2021-002"
}
],
"id": "CVE-2021-28090",
"lastModified": "2024-11-21T05:59:04.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-03-19T05:15:12.870",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40316"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/node/2009"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://bugs.torproject.org/tpo/core/tor/40316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.torproject.org/tpo/core/tor/-/issues/40316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPDXB2GZHG3VNOTWSXQ3QZVHNV76WCU5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202107-25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-03 03:55
Modified
2025-04-11 00:51
Severity ?
Summary
Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.2 | |
| torproject | tor | 0.0.3 | |
| torproject | tor | 0.0.4 | |
| torproject | tor | 0.0.5 | |
| torproject | tor | 0.0.6 | |
| torproject | tor | 0.0.6.1 | |
| torproject | tor | 0.0.6.2 | |
| torproject | tor | 0.0.7 | |
| torproject | tor | 0.0.7.1 | |
| torproject | tor | 0.0.7.2 | |
| torproject | tor | 0.0.7.3 | |
| torproject | tor | 0.0.8.1 | |
| torproject | tor | 0.0.9.1 | |
| torproject | tor | 0.0.9.2 | |
| torproject | tor | 0.0.9.3 | |
| torproject | tor | 0.0.9.4 | |
| torproject | tor | 0.0.9.5 | |
| torproject | tor | 0.0.9.6 | |
| torproject | tor | 0.0.9.7 | |
| torproject | tor | 0.0.9.8 | |
| torproject | tor | 0.0.9.9 | |
| torproject | tor | 0.0.9.10 | |
| torproject | tor | 0.1.0.10 | |
| torproject | tor | 0.1.0.11 | |
| torproject | tor | 0.1.0.12 | |
| torproject | tor | 0.1.0.13 | |
| torproject | tor | 0.1.0.14 | |
| torproject | tor | 0.1.0.15 | |
| torproject | tor | 0.1.0.16 | |
| torproject | tor | 0.1.0.17 | |
| torproject | tor | 0.1.1.20 | |
| torproject | tor | 0.1.1.21 | |
| torproject | tor | 0.1.1.22 | |
| torproject | tor | 0.1.1.23 | |
| torproject | tor | 0.1.1.24 | |
| torproject | tor | 0.1.1.25 | |
| torproject | tor | 0.1.1.26 | |
| torproject | tor | 0.1.2.13 | |
| torproject | tor | 0.1.2.14 | |
| torproject | tor | 0.1.2.15 | |
| torproject | tor | 0.1.2.16 | |
| torproject | tor | 0.1.2.17 | |
| torproject | tor | 0.1.2.18 | |
| torproject | tor | 0.1.2.19 | |
| torproject | tor | 0.2.0.30 | |
| torproject | tor | 0.2.0.31 | |
| torproject | tor | 0.2.0.32 | |
| torproject | tor | 0.2.0.33 | |
| torproject | tor | 0.2.0.34 | |
| torproject | tor | 0.2.0.35 | |
| torproject | tor | 0.2.2.18 | |
| torproject | tor | 0.2.2.19 | |
| torproject | tor | 0.2.2.20 | |
| torproject | tor | 0.2.2.21 | |
| torproject | tor | 0.2.2.22 | |
| torproject | tor | 0.2.2.23 | |
| torproject | tor | 0.2.2.24 | |
| torproject | tor | 0.2.2.25 | |
| torproject | tor | 0.2.2.26 | |
| torproject | tor | 0.2.2.27 | |
| torproject | tor | 0.2.2.28 | |
| torproject | tor | 0.2.2.29 | |
| torproject | tor | 0.2.2.30 | |
| torproject | tor | 0.2.2.31 | |
| torproject | tor | 0.2.2.32 | |
| torproject | tor | 0.2.2.33 | |
| torproject | tor | 0.2.2.34 | |
| torproject | tor | 0.2.2.35 | |
| torproject | tor | 0.2.2.36 | |
| torproject | tor | 0.2.2.37 | |
| torproject | tor | 0.2.2.38 | |
| torproject | tor | 0.2.3 | |
| torproject | tor | 0.2.3.13 | |
| torproject | tor | 0.2.3.14 | |
| torproject | tor | 0.2.3.15 | |
| torproject | tor | 0.2.3.16 | |
| torproject | tor | 0.2.3.17 | |
| torproject | tor | 0.2.3.18 | |
| torproject | tor | 0.2.3.19 | |
| torproject | tor | 0.2.3.20 | |
| torproject | tor | 0.2.3.21 | |
| torproject | tor | 0.2.3.22 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:rc:*:*:*:*:*:*",
"matchCriteriaId": "F3DD911A-0FE2-4957-822A-ACA45A406547",
"versionEndIncluding": "0.2.3.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42286A56-BB47-4A3E-B092-1057311D4960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre13:*:*:*:*:*:*",
"matchCriteriaId": "47511223-D650-4207-9856-DE025823231A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre14:*:*:*:*:*:*",
"matchCriteriaId": "0AD6C8F2-3050-453B-8942-A1916E3FC12B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre15:*:*:*:*:*:*",
"matchCriteriaId": "B34E2465-7E2D-40FA-B8F7-33B057C459CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre16:*:*:*:*:*:*",
"matchCriteriaId": "CB68EBE3-3517-4D04-8F40-7DE3A21BE9D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre17:*:*:*:*:*:*",
"matchCriteriaId": "A4C33393-220A-46D7-8C9F-67E5623A5F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre18:*:*:*:*:*:*",
"matchCriteriaId": "5519509B-B07D-4514-A404-D812DBF3239D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre19:*:*:*:*:*:*",
"matchCriteriaId": "D65FBECD-2EA2-4779-9198-B3CA4B67A49B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre20:*:*:*:*:*:*",
"matchCriteriaId": "CF20BBD0-CA62-4FB2-B46D-F9BBFEF452F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre21:*:*:*:*:*:*",
"matchCriteriaId": "F2317720-AC9D-4BA5-A334-34FA389AA097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre22:*:*:*:*:*:*",
"matchCriteriaId": "136DB452-2322-4FC5-A195-04E561D1D49F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre23:*:*:*:*:*:*",
"matchCriteriaId": "3D483797-8490-4625-8AF0-E6FF3C02CD72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre24:*:*:*:*:*:*",
"matchCriteriaId": "2341BDA5-859F-4BF4-A009-2DEB7902108B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre25:*:*:*:*:*:*",
"matchCriteriaId": "61C72051-52C5-43EC-88BD-C9E112C08827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre26:*:*:*:*:*:*",
"matchCriteriaId": "8699607B-7F86-4167-8CE8-699FE8F43D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.2:pre27:*:*:*:*:*:*",
"matchCriteriaId": "68ADC617-824D-4D1C-BDF8-4EB19D5656B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D04E67E7-93DD-4E8F-B88C-9C8C0721CDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D858688-5063-4D39-BF58-189333D71785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6978370D-97D0-4C26-B050-8B2045404D03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0A1F71E8-D642-4F22-B377-34F011BF9160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA9ACB8B-8185-4581-ABE4-0D8CE3A28BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B37E9B4D-E5C4-44AB-834D-8B37F3029001",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3E5A9D-4CA3-43D5-AF13-375B23891B51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B5561A8E-CF13-4243-975F-3E754494C4A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AD9BE-352A-4ED2-97DA-4D4948F87B27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3234D4EE-1B3F-4835-A387-F41D76178254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56068ADD-8079-497B-B031-1094F1DC15B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "206353C7-8644-4F44-96CD-1FBEB39F2771",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1C578AB-95AD-4160-9319-16A1497D528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "80CD91D9-CC8B-44AE-8FF9-056733B36E11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0CD8CC62-0C9F-47C8-B686-B376F2261ECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F74DBE38-B5F0-4FFC-9F98-7A55326A23EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "439B85D4-9DC8-447D-ACC8-EB12C43B4F3C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "85A83136-AF8F-46FE-848C-37B26EDBD1ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7BDE9034-B5AF-403A-8220-715347F44519",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "379069A5-CEAC-42E0-B905-39F0AF29C954",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.0.9.10:*:*:*:*:*:*:*",
"matchCriteriaId": "13A4435E-23A6-45F3-94B1-75219555DEDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0E2924-3559-419C-A033-391549D5E7E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "53E280D9-3371-4106-A0AA-ECE3AD2753F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9B608EB4-FC95-48CC-A90C-D079B2446F6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E04B4802-C2FC-45FF-9C27-0B8E6DF8F1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC41D6A9-B645-427F-B141-9A3ACC755FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7A28BAE2-8F08-4002-A700-AAC581CED48B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "7BD06667-698A-4F64-9431-727FC905C6C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB82CEC-AAE1-4393-B307-860AFB65C277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "0BDFC6E1-F7EB-4033-BB4B-58A9182694B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "45284729-472F-48FD-AC9F-707A3174ADD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "5B266267-98D0-4245-B455-08B2B9B69DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "CB3CD2DF-9659-4C0A-A046-9AC6E566A558",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.24:*:*:*:*:*:*:*",
"matchCriteriaId": "38A24E38-F136-41EA-A8EB-CD279EC9DE54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF29849-516A-4731-B6ED-767B09024232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.1.26:*:*:*:*:*:*:*",
"matchCriteriaId": "AA26D387-0326-4CD5-98B0-F67D5621D2A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "F05957B6-A8DF-4A04-8553-232101DEC9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "DC17296B-23A2-427B-8D41-4BED6E22DA60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "79B573F9-9966-4D61-802A-BBE3778FD3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F5D625E1-0DA6-483E-A251-E161E6108225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "6D07F398-828C-4008-BC3E-3E511339B437",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB18F2C-1E37-48FA-9DAE-C20B9B7B80E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.1.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "39D81D6F-372A-41AE-B42D-2BB1C4D4AB4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "52D2C091-8D45-4AC7-93FD-BAD81F2D6D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.31:*:*:*:*:*:*:*",
"matchCriteriaId": "3283E8DB-8238-4796-9CEB-207C6BF1E797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9737DA01-3E58-4229-AB03-16646F703F83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D6B2D6EF-7451-4A78-87D0-9339F3E2AB2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.34:*:*:*:*:*:*:*",
"matchCriteriaId": "D7ECB794-8331-48E7-BCD2-B9822F9C114A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.0.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1F293F19-E2AA-4133-B4D0-C5E1B2AF9CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "10344C2C-3137-4D2F-99A7-7802B80DE126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C0182C38-23CC-4E54-8C3F-6AA4A3B863DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "7B75EC06-BF76-4CA0-B604-6324AC6FC240",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "16C53110-3FDC-4F28-9C4D-D08E14C6DB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "729E4E08-2556-4A29-829D-318719EE734B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "8B138D53-A28F-43CC-91F1-6B073A2F10F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "7B20CCDC-94FF-4BDA-9111-E47AA8D475BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "BB96E018-34C5-4462-B89C-55C42C8384D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "BE594F43-0630-4937-A7AB-F8F9590A4167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "66A60CAC-A278-4AA2-A89A-E00E3D3B4127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "787E7A32-2CC4-43C1-8324-66772736F4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "36A36AAD-FB31-4793-A64B-1FAD90654687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "B5D9043C-E793-4505-9499-03B36D1F1545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "C0964E57-978F-445F-BBB1-817DBA1E8517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "933AC26E-E1CD-4B5B-B15A-31796B4B843F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "930D1039-AE12-41DE-BF9E-5BCB3FF396E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "5ABBC508-673E-405E-8760-EA156C3A1B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.35:*:*:*:*:*:*:*",
"matchCriteriaId": "93DBADBE-A941-4253-A509-9484BAF0FB7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.36:*:*:*:*:*:*:*",
"matchCriteriaId": "60D4C951-CA2B-44F5-97C7-C1BE4B27B0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "146CEE2D-5FD6-4F2F-95E2-AB9D982C1D34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.2.38:*:*:*:*:*:*:*",
"matchCriteriaId": "70EB1D7F-0E37-43B4-86CB-3E3D91056974",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A308F86E-B64B-40CA-A880-827F5FDCFCC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.13:alpha:*:*:*:*:*:*",
"matchCriteriaId": "888C8557-D3B3-43C9-9602-AA707EA20D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.14:alpha:*:*:*:*:*:*",
"matchCriteriaId": "1A50B658-1049-4467-B95E-2F697F2DD8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.15:alpha:*:*:*:*:*:*",
"matchCriteriaId": "D60AE56E-EE6D-4992-BD5B-5E32F5DDB385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.16:alpha:*:*:*:*:*:*",
"matchCriteriaId": "695A8085-2198-4DB7-BA5B-734063FB74D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.17:beta:*:*:*:*:*:*",
"matchCriteriaId": "35936C42-AAA8-40FC-803D-2F56D8B881BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.18:rc:*:*:*:*:*:*",
"matchCriteriaId": "EB448439-B7C3-441F-8923-AC125324A517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.19:rc:*:*:*:*:*:*",
"matchCriteriaId": "9F471155-F0ED-4F73-A04C-EF39DFC9F666",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.20:rc:*:*:*:*:*:*",
"matchCriteriaId": "D93C514A-0BCB-4BDD-84C2-6C78D346FC13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.21:rc:*:*:*:*:*:*",
"matchCriteriaId": "5F4A9816-F5D0-42DA-9ADB-F0D2B4A08A74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:torproject:tor:0.2.3.22:rc:*:*:*:*:*:*",
"matchCriteriaId": "6B44CB99-1F06-4042-A8AA-AB520DE38511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly."
},
{
"lang": "es",
"value": "Tor anterior a 0.2.3.24-rc permite a atacantes remotos causar una denegaci\u00f3n de servicio (fallo de aserci\u00f3n y cierre de demonio) mediante la realizaci\u00f3n de la negociaci\u00f3n del protocolo de enlace de forma incorrecta."
}
],
"id": "CVE-2012-2250",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-02-03T03:55:03.660",
"references": [
{
"source": "security@debian.org",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://gitweb.torproject.org/tor.git?a=blob_plain%3Bhb=HEAD%3Bf=ChangeLog"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-04 18:29
Modified
2025-04-20 01:37
Severity ?
Summary
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/101665 | Broken Link | |
| cve@mitre.org | http://www.securitytracker.com/id/1041610 | Broken Link | |
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2018:2692 | Third Party Advisory | |
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2018:2693 | Third Party Advisory | |
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2018:3403 | Third Party Advisory | |
| cve@mitre.org | https://access.redhat.com/errata/RHSA-2018:3458 | Third Party Advisory | |
| cve@mitre.org | https://blog.torproject.org/tor-browser-709-released | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://bugzilla.mozilla.org/show_bug.cgi?id=1412081 | Exploit, Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201810-01 | Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201811-13 | Third Party Advisory | |
| cve@mitre.org | https://trac.torproject.org/projects/tor/ticket/24052 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/ | Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://www.debian.org/security/2018/dsa-4327 | Third Party Advisory | |
| cve@mitre.org | https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/ | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101665 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041610 | Broken Link | |
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2018:2692 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2018:2693 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2018:3403 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://access.redhat.com/errata/RHSA-2018:3458 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://blog.torproject.org/tor-browser-709-released | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.mozilla.org/show_bug.cgi?id=1412081 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201810-01 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201811-13 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://trac.torproject.org/projects/tor/ticket/24052 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/ | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2018/dsa-4327 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/ | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| torproject | tor | * | |
| apple | macos | - | |
| linux | linux_kernel | - | |
| redhat | enterprise_linux_desktop | 6.0 | |
| redhat | enterprise_linux_desktop | 7.0 | |
| redhat | enterprise_linux_eus | 7.5 | |
| redhat | enterprise_linux_eus | 7.6 | |
| redhat | enterprise_linux_eus | 7.7 | |
| redhat | enterprise_linux_server | 6.0 | |
| redhat | enterprise_linux_server | 7.0 | |
| redhat | enterprise_linux_server_aus | 7.6 | |
| redhat | enterprise_linux_server_aus | 7.7 | |
| redhat | enterprise_linux_server_tus | 7.6 | |
| redhat | enterprise_linux_server_tus | 7.7 | |
| redhat | enterprise_linux_workstation | 6.0 | |
| redhat | enterprise_linux_workstation | 7.0 | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFA8BD30-17FD-4657-83DA-FCD87911419C",
"versionEndExcluding": "7.0.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0CF73560-2F5B-4723-A8A1-9AADBB3ADA00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5BF3C7A5-9117-42C7-BEA1-4AA378A582EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "83737173-E12E-4641-BC49-0BD84A6B29D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7431ABC1-9252-419E-8CC1-311B41360078",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B76AA310-FEC7-497F-AF04-C3EC1E76C4CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "17F256A9-D3B9-4C72-B013-4EFD878BFEA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected."
},
{
"lang": "es",
"value": "El navegador Tor en versiones anteriores a la 7.0.9 en macOS y Linux permite que atacantes remotos sin omitan las caracter\u00edsticas de anonimato previstas y descubran una direcci\u00f3n IP de cliente mediante vectores que impliquen un sitio web manipulado que aproveche la mala gesti\u00f3n de file:// en Firefox. Esto tambi\u00e9n se conoce como TorMoil. NOTA: Tails no se ha visto afectado."
}
],
"id": "CVE-2017-16541",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-04T18:29:00.187",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101665"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.securitytracker.com/id/1041610"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2692"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2693"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3403"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3458"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/tor-browser-709-released"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201810-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24052"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4327"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101665"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securitytracker.com/id/1041610"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2692"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:2693"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2018:3458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://blog.torproject.org/tor-browser-709-released"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1412081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201810-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://trac.torproject.org/projects/tor/ticket/24052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.bleepingcomputer.com/news/security/tormoil-vulnerability-leaks-real-ip-address-from-tor-browser-users/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2018/dsa-4327"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://www.wearesegment.com/research/tormoil-torbrowser-unspecified-critical-security-vulnerability/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}