Lucene search

K
osvGoogleOSV:DLA-17-1
HistoryJul 31, 2014 - 12:00 a.m.

tor - new upstream version

2014-07-3100:00:00
Google
osv.dev
10

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

The Tor version previously in Debian squeeze, 0.2.2.39, is no longer
supported by upstream.

This update brings the currently stable version of Tor, 0.2.4.23, to
Debian squeeze.

Changes include use of stronger cryptographic primitives, always
clearing bignums before freeing them to avoid leaving key material in
memory, mitigating several linkability vectors such as by disabling
client-side DNS caches, blacklisting authority signing keys potentially
compromised due to heartbleed, updating the list of directory
authorities, and much more.

We recommend that you upgrade your tor packages.

For Debian 6 Squeeze, these issues have been fixed in tor version 0.2.4.23-1~deb6u1

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N