openSUSE 16 Security Update : tor (openSUSE-SU-2026:21660-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21660-1 advisory. Changes in tor: - Update to 0.4.9.11 Major bugfixes - onion services: Prevent a race condition boo1275918, CVE-2026-77638 - client: no longer...

CVE-2026-77584

A flaw was found in Tor where a malicious client could trigger a use-after-free UAF vulnerability. This occurs when the software fails to properly manage memory after a circuit is freed, specifically due to the improper handling of CONFLUXLINK cells on circuits with attached streams. By sending a...

CVE-2026-77584

Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...