CVE-2012-3518

Tor before 0.2.2.38 has a vulnerability in networkstatus_parse_vote_from_string when handling an invalid flavor name, enabling a remote attacker to trigger an out-of-bounds read and daemon crash via crafted vote or consensus documents. Affected versions are prior to 0.2.2.38; remediation is to up...

CVE-2012-3517

CVE-2012-3517 affects Tor before 0.2.2.38; the issue is a use‑after‑free in dns.c that can cause a daemon crash (DoS) via failed DNS requests. Remediation is upgrade to 0.2.2.38 or newer (e.g., 0.2.2.39 in some distributions). Public advisories and OpenVAS/NASL entries reference this CVE alongsid...

CVE-2012-3518

The networkstatusparsevotefromstring function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted 1 vote document or 2 consensus document...

CVE-2012-3519

CVE-2012-3519 affects Tor; routerlist.c in Tor before 0.2.2.38 uses different timing for relay-list iteration, enabling a timing side-channel to leak information about relay selection. Public discussion items in Debian/OSS advisories confirm the vulnerability and that the OpenBSD/OpenSSL-style fi...

CVE-2012-3518

The networkstatusparsevotefromstring function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted 1 vote document or 2 consensus document...

CVE-2012-3519

routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack...

Deep Packet Inspection Firm Cyberoam Issues Fix Following Private Key Leak

Network security firm Cyberoam issued an over the air update for all of its Deep Packet Inspection DPI devices today after a decrypted version of the company’s universal private key was leaked online over the weekend. The New Jersey-based company pushed the hotfix after an anonymous commenter...

Cyberoam advisory

Vulnerability in Cyberoam DPI devices 30 Jun 2012 CVE-2012-3372 =================================================================== Cyberoam make a range of DPI devices http://www.cyberoamworks.com/ which are capable of intercepting SSL connections. In common with all such devices, in order to...

CVE-2012-3372 : Traffic Interception Vulnerability found in Cyberoam

Traffic Interception Vulnerability found in Cyberoam The TOR team have discovered a fake certificate in the wild. The certificate, issued by a US company called Cyberoam, was used in an attempt to trick a user in Jordan into believing that her/his connection to the TOR website, was private and...

OpenVPN Defaced by Hackers

OpenVPN Defaced by Hackers OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features Got Hacked Yesterday by Hacker called "HcJ". Hacked deface the page as shown in above picture. Words form Page: OPENVPN Hacked No Ne...

What is the Deep Web? A first trip into the abyss

The Deep Web or Invisible web is the set of information resources on the World Wide Web not reported by normal search engines. According several researches the principal search engines index only a small portion of the overall web content, the remaining part is unknown to the majority of web user...

Firefox security bug (proxy-bypass) in current Tor BBs

https://blog.torproject.org/blog/firefox-security-bug-proxy-bypass-current-tbbs "A user has discovered a severe security bug in Firefox related to websockets bypassing the SOCKS proxy DNS configuration. This means when connecting to a websocket service, your Firefox will query your local DNS...

Tor Warns of Firefox Bug That Threatens User Privacy

The developers at the Tor Project are warning users about a serious flaw in Firefox that’s included the latest version of the Tor Browser Bundle that could enable an attacker to gather information about the servers a victim is using, poking a hole in the privacy and anonymity that Tor is designed...

[SECURITY] Fedora 15 Update: mozilla-https-everywhere-2.0.3-2.fc15

HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to...

[SECURITY] Fedora 16 Update: mozilla-https-everywhere-2.0.3-2.fc16

HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to...

Fedora Update for tor FEDORA-2011-17248

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for tor FEDORA-2011-17248

Check for the Version of tor OpenVAS Vulnerability Test Fedora Update for tor FEDORA-2011-17248 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Tor Browser Bundle information leakage

Debugging logging is always on...

Tor Browser Bundle for Linux (2.2.35-8) "EVIL bug"

"There is an EVIL bug in at least the Linux 2.2.35-8 Tor Browser Bundle start-tor-browser script. It will log things like domain names to a file in the root of the browser bundle." https://trac.torproject.org/projects/tor/ticket/5417 Ticket 5417 new defect RelativeLink.sh in Tor browser bundle ha...

Fedora Update for tor FEDORA-2011-15208

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...