CVE-2017-0375

The CVE-2017-0375 issue affects Tor’s hidden-service feature prior to 0.3.0.8, where a malformed BEGIN cell can trigger an assertion failure in relay_send_end_cell_from_edge_, causing a daemon crash (DoS). Affected software is Tor, with the root cause in the hidden service handling code. Remediat...

CVE-2017-0376

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service assertion failure and daemon exit in the connectionedgeprocessrelaycell function via a BEGINDIR cell on a rendezvous circuit...

CVE-2017-0376

The CVE-2017-0376 vulnerability affects Tor prior to 0.3.0.8, caused by a flaw in the hidden-service code when receiving a BEGIN_DIR cell on a hidden service rendezvous circuit. This can trigger an assertion failure and daemon exit, resulting in denial of service. Upstream fixes are in Tor 0.3.0....

Debian: Security Advisory (DSA-3877-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2016-5026

hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory...

ProtonMail Gets Own Tor-Accessible .Onion Hidden Service

Users of the encrypted email service ProtonMail looking for an extra layer of security now have the option of accessing their inbox directly through the Tor network. ProtonMail, originally developed by CERN and MIT scientists, announced Thursday it had added its own Tor hidden service. According ...

[SECURITY] Fedora 24 Update: onionshare-0.9.1-1.fc24

OnionShare lets you securely and anonymously share files of any size. It wo rks by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL to access and download files. It doesn't requ ire setting up a server on the internet somewhere or using a thir...

[SECURITY] Fedora 25 Update: onionshare-0.9.1-1.fc25

OnionShare lets you securely and anonymously share files of any size. It wo rks by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL to access and download files. It doesn't requ ire setting up a server on the internet somewhere or using a thir...

MGASA-2017-0008 Updated tor package fixes security vulnerability

It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation...

Updated tor package fixes security vulnerability

It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation...

openSUSE Security Update : tor (openSUSE-2016-1527)

This update for tor fixes the following issues : - a hostile hidden service could cause tor clients to crash boo1016343, CVE-2016-1254 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Debian DLA-754-1 : tor security update

It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation. For...

Debian DSA-3741-1 : tor - security update

It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation...

The vulnerability of Tor’s software allows a remote attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Tor due to the handling of the chain after a client receives an incoming cell with RELAYEARLY. Exploiting this vulnerability allows malicious actors operating remotely to carry out an attack with confirmation of traffic, using the RELAY and RELAYEARLY cells as means to...

Anonymous VPN Adapter: OnionCat

OnionCat is a VPN -adapter which allows to connect two or more computers or networks through VPN-tunnels. It is designed to use the anonymization networks Tor or I2P as its transport, hence, it provides location-based anonymity while still creating tunnel end points with private unique IP...

[SECURITY] Fedora 23 Update: onionshare-0.7.1-1.fc23

OnionShare lets you securely and anonymously share files of any size. It wo rks by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL to access and download files. It doesn't requ ire setting up a server on the internet somewhere or using a thir...

[SECURITY] Fedora 22 Update: onionshare-0.7.1-1.fc22

OnionShare lets you securely and anonymously share files of any size. It wo rks by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL to access and download files. It doesn't requ ire setting up a server on the internet somewhere or using a thir...

[SECURITY] Fedora 21 Update: onionshare-0.7.1-1.fc21

OnionShare lets you securely and anonymously share files of any size. It wo rks by starting a web server, making it accessible as a Tor hidden service, and generating an unguessable URL to access and download files. It doesn't requ ire setting up a server on the internet somewhere or using a thir...

Mandriva Linux Security Advisory : tor (MDVSA-2015:205)

Updated tor packages fix security vulnerabilities : disgleirio discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible CVE-2015-2928. DonnchaC discovered that Tor clients would crash with an...

MGASA-2015-0151 Updated tor packages fix security vulnerabilities

"disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible CVE-2015-2928. "DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidde...