Design/Logic Flaw

Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building...

Design/Logic Flaw

Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had...

CVE-2011-4897

Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value...

CVE-2011-4894

CVE-2011-4894 affects Tor prior to 0.2.2.34 when run as a bridge. The issue is that DirPort connections are used directly for directory fetches instead of a Tor TLS connection, which can enable remote observers to enumerate bridges by monitoring DirPort activity. The available connected documents...

CVE-2011-4896

Technical details (affected products, versions, root cause, fixes) are not provided in the connected documents. The CVE description remains the only published detail. Monitor for official updates.

CVE-2011-2768

Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had...

CVE-2011-2769

Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATEFAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values...

CVE-2011-2778

Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code by 1 establishing a SOCKS connection to SocksPort or 2 leveraging a SOCKS proxy configuration...

CVE-2011-4896

Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the bridge port...

CVE-2011-4896

Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the bridge port...

CVE-2011-2769

Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATEFAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values...

CVE-2011-4895

Tor before 0.2.2.34, when configured as a bridge, builds circuits in a way that differs from client circuits, making it easier for remote attackers to enumerate bridges by observing circuit construction. Affects Tor code path used for bridges; vulnerability achieved through the bridge-circuit set...

CVE-2011-4894

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

CVE-2011-2768

Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had...

CVE-2011-2768

CVE-2011-2768 affects Tor before 0.2.2.34 when configured as a client or bridge. The vulnerability arises because Tor may send a TLS certificate chain as part of an outgoing OR connection, enabling remote relays to read the chain and infer the client’s entry guard set, thereby compromising anonym...

CVE-2011-4894

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

CVE-2011-4897

CVE-2011-4897 : Affects Tor before 0.2.2.25-alpha when configured as a relay without the Nickname option; it uses the local hostname as the Nickname, exposing potentially sensitive information to remote readers. Connected advisories consistently describe the same behavior and impact. Some entries...

CVE-2011-2778

Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code by 1 establishing a SOCKS connection to SocksPort or 2 leveraging a SOCKS proxy configuration...

CVE-2011-2778

Tor vulnerability CVE-2011-2778 involves a heap-based buffer overflow in or/buffers.c that could allow remote code execution or memory corruption when using SocksPort or SOCKS proxy configuration. Affected product: Tor. Impact: remote attacker may cause memory corruption or execute arbitrary code...

CVE-2011-2769

Affected software: Tor prior to 0.2.2.34. Issue: When Tor is configured as a bridge, it accepts CREATE and CREATE_FAST in a cell’s Command field within an OR connection it initiated, enabling remote relays to enumerate bridges. Impact: Bridge enumeration could reveal bridge presence to adversarie...